A new wave of the GhostAction supply-chain campaign has pushed a credential-stealing workflow into tens of thousands of GitHub repositories, and this time it hunts for cloud and artificial-intelligence keys buried in source code and git history, not just the secrets stored in continuous integration.

Security firm Socket, which reported the wave, says it has identified more than 500 GitHub accounts that committed the malicious workflow since 7 October 2026, including several organisation-owned repositories reached through compromised contributors. Among them were uber/athenadriver and kitao/pyxel, a project with 18,420 stars that ships through both PyPI and crates.io.

How the malicious workflow works

The workflow arrives as a file named security-audit.yml, committed straight to the default branch with messages reading “Add security audit workflow” or “Update security audit workflow”. Despite the name, it has no security function: it runs on any push to any branch or tag, and it posts whatever it finds to an attacker-controlled server at 193.32.204[.]199.

The payload matches 13 patterns covering AWS keys, Anthropic, OpenAI and OpenRouter keys, GitHub and GitLab tokens, Google API keys, Slack tokens and SendGrid keys. It also captures two lines on either side of every AWS key ID, because the 40-character secret key usually sits nearby, letting the attacker reassemble usable AWS key pairs rather than orphaned identifiers.

The new variant goes further than earlier waves. It sets fetch-depth to 0, pulling every branch and tag, then runs git log -p --all so it can read the full patch history. That exposes credentials a developer believed they had deleted from the current code but never rotated.

A campaign that keeps coming back

GitGuardian first documented GhostAction in September 2025, when it hit 817 repositories across 327 users and exfiltrated 3,325 secrets. The later tally puts the campaign at more than 30,000 repositories across 3,000 users and organisations, attributed to about 1,900 compromised accounts, with 3,174 secrets targeted in public repositories. One burst hit roughly 28,000 new repositories between 8 and 9 October.

Socket calls kitao/pyxel the highest-value target: the payload named its Cargo registry token, PyPI username and password, and a personal access token. Socket had seen no malicious package releases from the campaign at the time of writing.

Unlike the September 2026 wave, in which GitHub held most runs for approval, these runs executed and exfiltrated data. GitHub began blocking the workflow from running on 9 October, so later waves on 10 and 12 October could not extract secrets. GitGuardian also found that the actor relies partly on unrotated secrets stolen in earlier campaigns.

What repository owners should do

Defenders should read the secret list in any injected workflow file: a populated list means Actions secrets were exposed, while an empty one means only the repository sweep applies. Every named secret should be rotated, and exposed personal access tokens should be revoked rather than rotated.

Owners should also scan their full git history for the 13 credential classes and rotate anything found, review CloudTrail for AWS keys, remove the workflow, treat the account as compromised, enforce phishing-resistant multi-factor authentication, and block the exfiltration address. GitGuardian stresses that the GitHub credential used for the injection must also be revoked, because stolen tokens are often reused by other actors, including cryptominer operators.