Key points
- GhostAction campaign compromised 346 GitHub repositories on October 8.
- Attackers used hijacked accounts henrywoo and kitao to add fake security workflows.
- Malicious scripts exfiltrated CI/CD secrets, API tokens, and hardcoded credentials.
The short version
- 346 repositories were affected by the latest GhostAction attack campaign.
- Two hijacked maintainer accounts facilitated the unauthorized code injections.
- Stolen data includes cloud keys, API tokens, and source-code history secrets.
The details
Security firm Socket reported on October 8 that a new GhostAction campaign compromised 346 GitHub repositories. The threat actors utilized two hijacked maintainer accounts, identified as henrywoo and kitao, to execute the intrusion. These accounts had write access to multiple projects, allowing the attackers to modify repository settings and inject malicious code. The compromised repositories included high-profile targets such as Uber’s uber/athenadriver project and the popular kitao/pyxel library, which holds more than 18,000 stars on the platform.
According to Cyber Security News, the activity was concentrated in a short time window on October 8. The attackers added a file named .github/workflows/security-audit.yml to each affected repository. The commits were labeled innocuously as “Add security audit workflow” and “Update security audit workflow” to avoid immediate suspicion. This automated process affected 318 repositories under the henrywoo namespace, including 279 forks, as well as 27 repositories under kitao. The campaign targeted both active projects and inactive repositories that had not received updates for years, demonstrating a highly automated approach to mass compromise.
The context
The malicious workflow is designed to run automatically when developers push code changes to the repository. Once triggered, the script collects sensitive data stored in GitHub Actions secrets. This includes PyPI passwords, crates.io tokens, GitHub personal access tokens, and package publishing credentials. The newer version of GhostAction also searches the active repository files and the full Git history for hardcoded secrets. By using fetch-depth: 0, the workflow downloads the complete repository history before scanning it. This allows attackers to find credentials that developers may have removed from current files but left exposed in older commits, branches, or tags.
Researchers noted that the payload looks for AWS access key IDs, secret keys, temporary session tokens, and API keys for OpenAI, Anthropic, and OpenRouter. It also captures surrounding lines near AWS key IDs to help locate matching secret keys. According to Socket’s investigation, the stolen data is sent via an HTTP POST request to the IP address 193.32.204[.]199. The campaign highlights how a single stolen maintainer account can expose far more than one personal repository. Once attackers gain write access, they can add workflows to every repository the account can modify, placing CI/CD credentials within their reach.
What should you do?
Developers should audit their GitHub account permissions and revoke access for any unused or suspicious maintainer accounts. Review recent commits in critical repositories for unauthorized workflow files, especially those labeled as security audits. Rotate all exposed API tokens, cloud keys, and personal access tokens immediately. Monitor repository activity logs for unusual pushes from hijacked accounts.
What to do and how to stay safe: GitHub
- Audit maintainer permissions on all GitHub repositories and remove unnecessary write access.
- Scan repository history for unauthorized workflow files like security-audit.yml.
- Rotate all API tokens, cloud keys, and credentials that may have been exposed.
- Enable mandatory two-factor authentication and branch protection rules on critical repos.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which repositories were compromised in the GhostAction attack?
The attack affected 346 repositories, including Uber’s uber/athenadriver and the kitao/pyxel project, connected to the hijacked accounts henrywoo and kitao.
How did the attackers steal secrets from the repositories?
They added a malicious workflow file that runs on code pushes, collecting CI/CD secrets and scanning Git history for hardcoded credentials.
What data was exfiltrated by the GhostAction campaign?
The campaign stole API tokens, cloud keys, passwords, and credentials stored in both active files and historical commits.
