Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Researchers attribute a large ongoing supply-chain credential-theft campaign named GhostAction to compromised GitHub maintainer accounts that injected malicious workflows (e.g., security-audit.yml, github_actions_security.yml) into hundreds of repositories; the workflows check out full history, scan for 13 credential patterns, pair AWS keys, and exfiltrate secrets (PyPI, npm, DockerHub, cloud and AI API keys, GitHub/GitLab tokens) to a hard-coded IP (193.32.204.199). Over dozens to hundreds of accounts and thousands of repositories have been impacted since late August 2026, with thousands of secrets exfiltrated and at least one observed case of a Docker image containing an XMRig miner; recommended mitigations include revoking compromised credentials, rotating keys, deleting malicious workflows, and auditing forks and private mirrors.