GhostAction, a supply chain attack campaign first documented in September 2025, has escalated sharply. According to GitGuardian, a spike on October 8–9, 2026 compromised roughly 1,900 GitHub accounts and targeted more than 30,000 repositories across 3,000 users and organizations. The attackers attempted to extract 3,174 secrets from public repositories' CI environments.
The campaign works by compromising legitimate developer accounts, often using personal access tokens or credentials harvested from infostealer logs. The attackers then push a malicious workflow file with a deceptive name such as 'security-audit.yml' or 'github_actions_security.yml' to gain a foothold. The ultimate goal is large-scale theft of CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys.
A new wave observed since August 31, 2026 appears more experimental and manual than earlier efforts, with the payload evolving over time. GitGuardian described three variants: the first added a git history secret-scanning feature; the second captured context around AWS key IDs to pair them with matching secret access keys; and the third added support for retrieving secret context during the scan. The payload was deployed in phases, first to 160 previously observed victims and then, 20 minutes later, to 28,000 new repositories. Later waves on October 10 and 12 were blocked because GitHub started preventing the malicious workflow from running on October 9.
Notably, some victims in this burst had been compromised in earlier waves, suggesting the attackers are counting on unrotated secrets to succeed. The incident underscores the need for developers to rotate credentials and audit workflow changes, especially in repositories with access to sensitive CI/CD pipelines.