Threat reportSupply ChainTL-2026-4678
GhostAction GitHub Actions Supply-Chain Campaign: October 2026 Wave Largely Blocked, Attackers Retain Access to ~1,800 Compromised Accounts
GhostAction GitHub Actions Supply-Chain Campaign (TL-2026-4678), also tracked as GhostAction, is a high-severity supply-chain compromise, first published 2026-10-28. It has no confirmed attribution, affects GitHub GitHub Actions / GitHub-hosted repositories (via compromised, maps to 10 MITRE ATT&CK techniques (T1036, T1059.004, T1071.001), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4678
- Threat ID
- TL-2026-4678
- Also known as
- GhostAction, GhostAction Returns
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, open-source, cloud-services, ai-ml
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in GhostAction GitHub Actions Supply-Chain Campaign
Malware and tooling: GhostAction, actions/checkout@v4 with fetch-depth: 0
How GhostAction GitHub Actions Supply-Chain Campaign works
GhostAction operators hijack GitHub developer and maintainer accounts and push malicious GitHub Actions workflows that dump Actions secrets and mine git history for credentials. During the October 8-12, 2026 wave, workflows were pushed to roughly 30,000 repositories; GitHub blocked execution from October 9, but attackers reportedly retain access to nearly 1,800 compromised accounts and further waves with revised payloads are expected.
GhostAction is a credential-theft supply-chain campaign targeting GitHub-hosted CI/CD. It does not exploit a vulnerability in GitHub Actions; instead, operators obtain write access to developer and maintainer accounts through stolen personal access tokens (PATs), credentials harvested from infostealer logs and dumps, and hijacked maintainer accounts. Using that access they commit a workflow file with a deceptive name (security-audit.yml, github_actions_security.yml, and security-check.yml per StepSecurity) directly to the default branch, using the victim's real author identity and bland messages such as 'Add security audit workflow', 'Update security audit workflow' and 'Trigger security scan'. The workflow triggers on workflow_dispatch and on any unfiltered push, so operators can also run it manually; StepSecurity observed manual dispatches on kitao/pyxel consistent with hands-on verification.
The campaign first surfaced in September 2025 (more than 3,000 secrets stolen across 817 repositories belonging to 327 developers). A new wave began on August 31, 2026 (GitGuardian: 2,577 secrets targeted across 772 repositories in 373 users/organizations through September). The October 2026 payload evolved across versions: it checks out the repository with actions/checkout@v4 and fetch-depth: 0, greps the working tree and the entire git history (git log -p --all, capped at 200,000 lines and 300 unique credentials per StepSecurity) for 13 credential patterns, and captures about two lines of context around AWS key IDs (AKIA_CTX_START / AKIA_CTX_END markers) so that key IDs can be paired with secret access keys. Targeted material includes AWS keys and session tokens, GitHub (ghp_, github_pat_) and GitLab (glpat-) tokens, Google/Firebase AIza keys, Slack and SendGrid tokens, and AI provider keys (Anthropic, OpenAI, OpenRouter), plus npm, PyPI and DockerHub registry tokens and CI/CD secrets referenced by workflows.
Exfiltration is an HTTP POST via curl to a bare IP, 193.32.204.199 (ports 80 and 3000, path /api/workflow/receive?inj=<id>), with query markers /?c=monami (named secrets found) and /?c=new (history-derived matches only). No DNS is involved, which bypasses domain-based egress controls. The 2025 campaign used 45.139.104.115, 170.39.218.2 and *.oast.fun endpoints (StepSecurity). Because history is mined, deleted secrets remain in scope.
On October 8, 2026 the actor used two compromised maintainer accounts to push the workflow into 345 repositories in two windows of 24 and 16 minutes (StepSecurity), including kitao/pyxel (27 repos) and henrywoo (318 repos incl. forks; uber/athenadriver). GitGuardian reports a spike on October 8-9 reaching ~3,000 users/organizations and 30,000+ repositories, ~1,900 compromised accounts and 3,174 secrets targeted; a confirmed exfiltration run on uber/athenadriver delivered data to the C2 within 4 seconds. GitHub began preventing execution of the malicious workflows on October 9, and waves on October 10 and 12 extracted nothing. Per the hunt-sourced Dark Reading summary, the workflow side was 'highly ineffective' but the attackers retain access to nearly 1,800 accounts and pushed 72,000 commits to 23,000 public repositories between October 13-21 (this figure was not independently verified; Dark Reading returned HTTP 403). Attackers are described as banking on unrotated secrets, and new waves with revised payloads are expected. No named threat actor or nation-state attribution exists in the sources.
MITRE ATT&CK techniques used in TL-2026-4678
Defense Evasion
Execution
Command and Control
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Persistence
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Credentials In Files
Affected products and versions in GhostAction GitHub Actions Supply-Chain Campaign
- GitHub — GitHub Actions / GitHub-hosted repositories (via compromised accounts; no product vulnerability)
Vulnerable versions: Repositories whose maintainers' PATs or credentials are compromised and lack workflow-change controls
Fixed in: GitHub platform-side blocking of malicious workflow execution from 2026-10-09
Remediation for GhostAction GitHub Actions Supply-Chain Campaign
Immediate actions
- Revoke the GitHub PAT/session that authored the malicious commit and rotate all GitHub credentials for affected accounts
- Delete security-audit.yml, github_actions_security.yml and security-check.yml from ALL branches and forks, not just the default branch
- Rotate every Actions secret AND every credential ever committed to repository history (deleted secrets are in scope)
- Treat all 'Security Audit' / 'Github Actions Security' workflow runs since 2026-08-31 as confirmed exfiltration
- Block egress to 193.32.204.199 and hunt for it in .github/workflows (code search: "193.32.204.199" path:.github/workflows)
- Hold package/registry releases until npm, PyPI and DockerHub tokens are rotated
Workarounds
- Restrict which Actions/workflows may run at the organization level and require approval for workflow changes
- Audit repository audit logs for workflow-file commits not made through pull requests
Longer-term hardening
- Require pull request review (CODEOWNERS/branch protection) for changes under .github/workflows/
- Replace long-lived cloud keys with OIDC / workload identity federation and set read-only default GITHUB_TOKEN permissions
- Enable secret scanning with push protection
- Require phishing-resistant MFA for maintainers and monitor infostealer log exposure of developer credentials
- Restrict outbound network access from CI runners to an allowlist
Weaknesses (CWE) in GhostAction GitHub Actions Supply-Chain Campaign
Timeline of GhostAction GitHub Actions Supply-Chain Campaign
- New GhostAction wave begins; GitGuardian later counts 2,577 secrets targeted across 772 repositories (373 users/organizations) through September.
- Exfiltration endpoint 193.32.204.199 observed in campaign use since at least this date (per GitGuardian-sourced reporting).
- StepSecurity observes the endpoint deployed via the compromised account xxyangyoulin.
- More than 500 maintainer accounts reported compromised since this date, pushing credential-stealing workflows into public repositories.
- Two compromised maintainer accounts (kitao, henrywoo) used to push the workflow into 345 repositories in two windows of 24 and 16 minutes; uber/athenadriver run exfiltrates to the C2 within 4 seconds.
- Peak of the campaign (~30,000 repositories, ~3,000 owners, 3,174 secrets targeted); GitHub begins preventing execution of the malicious workflows.
- Follow-on wave blocked by GitHub's mitigation; no secrets extracted. A further wave on October 12 was likewise ineffective.
- The Hacker News publishes GitGuardian findings: ~1,900 compromised accounts and 30,000+ repositories targeted.
- Per hunt-sourced Dark Reading summary, between October 13-21 attackers pushed 72,000 commits to 23,000 public repositories from ~1,800 accounts they still control (unverified).
Sources cited for GhostAction GitHub Actions Supply-Chain Campaign
- GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
- GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
- StepSecurity: GhostAction Returns
- CSA Research Note: GhostAction Returns - Maintainer Takeover Steals Workflow Secrets
- GitGuardian: GhostAction Campaign - 3,325 Secrets Stolen (2025 campaign)
- GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos
- SC World: GhostAction campaign escalates, targeting over 30,000 GitHub repositories
- Breached.company: GhostAction Returns - malicious GitHub Actions workflow hits 500 accounts
Detection coverage for TL-2026-4678
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4678 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.