GhostAction’s New Wave Pulls Cloud Keys From Git History

GhostAction credential theft has grown past stolen CI/CD secrets. Socket’s research team says the campaign has committed a malicious GitHub Actions workflow to tens of thousands of repositories since October 7, 2026. More than 500 maintainer accounts are now compromised. The newest workflow also searches the working tree and the full git history for cloud and AI credentials that were ever committed.

How This GhostAction Wave Works

The campaign runs in three stages, Socket says. First, the operator gets a working credential for a maintainer account; Socket did not observe how. Second, the repository is scanned for the secret names its own workflows already use. Third, the file is committed straight to the default branch and runs on the next push.

Earlier GhostAction waves took only secrets already stored in GitHub Actions, which are mostly package-publishing tokens. This version keeps that step and adds a search across the committed codebase and its entire git history. Socket says this reaches credentials a developer removed from the current code but never rotated, including AWS keys and API keys for AI services such as Anthropic, OpenAI and OpenRouter.

Socket says this is a variant of a campaign GitGuardian first documented in September 2025 and again this year. The delivery method has not changed: a stolen maintainer credential is used to commit a workflow with a plausible name.

GhostAction Credential Theft Reaches Forks, AI Projects and Org-Owned Code

Socket’s clearest documented burst hit 346 repositories on October 8, 2026, through two compromised accounts it names as henrywoo and kitao. One of them, kitao, maintains kitao/pyxel, an 18,420-star project that ships through both PyPI and crates.io. The other account, henrywoo, had write access to Uber’s athenadriver repository as its original author, which is how an organization-owned project was reached through a single compromised personal account.

For Pyxel, Socket says the named Actions secrets include its Cargo registry token, PyPI username and password, and a personal access token. Those are exactly the publishing credentials an attacker would need to ship a malicious release. Socket says it has not observed a malicious package version published to PyPI or crates.io from this campaign, as of its October 9 report.

Brandefense Blackhole has logged 43 posts mentioning the GhostAction campaign across Telegram, forum and Discord channels since August 12, 2026, with activity continuing into early November. Socket also says the 279 forks under the henrywoo account each carry the same workflow file. Any fork with Actions enabled can still run it on its next push.

What to Do If Your Repositories Are Affected

Triage decides the order below. A workflow that named your Actions secrets means those secrets already ran once. A workflow that only grepped your code means the exposure could reach back years. Treat both as present if you are not sure which one you have.

1. Check your workflowsLook for a workflow you did not add that runs on every push with no branch filter, and see whether it checks out full history instead of one branch.
2. Rotate named secrets firstIf the workflow lists your own Actions secret names, rotate every one of them now and revoke any personal access token instead of just rotating it.
3. Check what those secrets could publishReview your package registry’s release history for versions you did not publish, and compare any you find against your own build output.
4. Scan your full git historySearch every branch and tag, not just the current one, for AWS keys, AI service keys, and source-control or SaaS tokens that were ever committed.
5. Rotate anything the history scan findsTreat a credential as exposed the moment it appears in any commit, even one you later removed, and rotate it regardless of what the current code shows.
6. Treat the account as compromisedRemove the workflow file, revert the commit everywhere it was pushed, then revoke the account’s sessions, tokens and SSH keys and require phishing-resistant MFA before re-enabling it.

GhostAction’s pattern is not new on its own. A compromised maintainer account is a common entry point for a supply chain attack. The earlier tj-actions GitHub Action compromise shows the same blast-radius problem: one write-scoped account can reach every repository it touches. For the ATT&CK mapping of this stage, see compromising a software supply chain, and for the account-takeover side, see our credential theft glossary entry.