# GhostAction GitHub Actions Supply-Chain Campaign: October 2026 Wave Largely Blocked, Attackers Retain Access to ~1,800 Compromised Accounts

> GhostAction operators hijack GitHub developer and maintainer accounts and push malicious GitHub Actions workflows that dump Actions secrets and mine git history for credentials. During the October 8-12, 2026 wave, workflows were pushed to roughly 30,000 repositories; GitHub blocked execution from October 9, but attackers reportedly retain access to nearly 1,800 compromised accounts and further waves with revised payloads are expected.

- **Published:** 2026-10-28T22:35:42Z
- **Last reviewed:** 2026-10-28T22:35:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4678
- **ID:** TL-2026-4678
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GhostAction is a credential-theft supply-chain campaign targeting GitHub-hosted CI/CD. It does not exploit a vulnerability in GitHub Actions; instead, operators obtain write access to developer and maintainer accounts through stolen personal access tokens (PATs), credentials harvested from infostealer logs and dumps, and hijacked maintainer accounts. Using that access they commit a workflow file with a deceptive name (security-audit.yml, github_actions_security.yml, and security-check.yml per StepSecurity) directly to the default branch, using the victim's real author identity and bland messages such as 'Add security audit workflow', 'Update security audit workflow' and 'Trigger security scan'. The workflow triggers on workflow_dispatch and on any unfiltered push, so operators can also run it manually; StepSecurity observed manual dispatches on kitao/pyxel consistent with hands-on verification.

The campaign first surfaced in September 2025 (more than 3,000 secrets stolen across 817 repositories belonging to 327 developers). A new wave began on August 31, 2026 (GitGuardian: 2,577 secrets targeted across 772 repositories in 373 users/organizations through September). The October 2026 payload evolved across versions: it checks out the repository with actions/checkout@v4 and fetch-depth: 0, greps the working tree and the entire git history (git log -p --all, capped at 200,000 lines and 300 unique credentials per StepSecurity) for 13 credential patterns, and captures about two lines of context around AWS key IDs (AKIA_CTX_START / AKIA_CTX_END markers) so that key IDs can be paired with secret access keys. Targeted material includes AWS keys and session tokens, GitHub (ghp_, github_pat_) and GitLab (glpat-) tokens, Google/Firebase AIza keys, Slack and SendGrid tokens, and AI provider keys (Anthropic, OpenAI, OpenRouter), plus npm, PyPI and DockerHub registry tokens and CI/CD secrets referenced by workflows.

Exfiltration is an HTTP POST via curl to a bare IP, 193.32.204.199 (ports 80 and 3000, path /api/workflow/receive?inj=<id>), with query markers /?c=monami (named secrets found) and /?c=new (history-derived matches only). No DNS is involved, which bypasses domain-based egress controls. The 2025 campaign used 45.139.104.115, 170.39.218.2 and *.oast.fun endpoints (StepSecurity). Because history is mined, deleted secrets remain in scope.

On October 8, 2026 the actor used two compromised maintainer accounts to push the workflow into 345 repositories in two windows of 24 and 16 minutes (StepSecurity), including kitao/pyxel (27 repos) and henrywoo (318 repos incl. forks; uber/athenadriver). GitGuardian reports a spike on October 8-9 reaching ~3,000 users/organizations and 30,000+ repositories, ~1,900 compromised accounts and 3,174 secrets targeted; a confirmed exfiltration run on uber/athenadriver delivered data to the C2 within 4 seconds. GitHub began preventing execution of the malicious workflows on October 9, and waves on October 10 and 12 extracted nothing. Per the hunt-sourced Dark Reading summary, the workflow side was 'highly ineffective' but the attackers retain access to nearly 1,800 accounts and pushed 72,000 commits to 23,000 public repositories between October 13-21 (this figure was not independently verified; Dark Reading returned HTTP 403). Attackers are described as banking on unrotated secrets, and new waves with revised payloads are expected. No named threat actor or nation-state attribution exists in the sources.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071.001 Web Protocols

## Sources

- [GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html)
- [GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub](https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github)
- [StepSecurity: GhostAction Returns](https://www.stepsecurity.io/blog/ghostaction-returns)
- [CSA Research Note: GhostAction Returns - Maintainer Takeover Steals Workflow Secrets](https://labs.cloudsecurityalliance.org/research/csa-research-note-ghostaction-returns-github-workflow-theft/)
- [GitGuardian: GhostAction Campaign - 3,325 Secrets Stolen (2025 campaign)](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/)
- [GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos](https://startwithidentity.com/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/)
- [SC World: GhostAction campaign escalates, targeting over 30,000 GitHub repositories](https://www.scworld.com/brief/ghostaction-campaign-escalates-targeting-over-30000-github-repositories)
- [Breached.company: GhostAction Returns - malicious GitHub Actions workflow hits 500 accounts](https://breached.company/ghostaction-returns-malicious-github-actions-workflow-hits-500-accounts-tens/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4678