GhostAction Supply Chain Campaign Expands: Malicious GitHub Actions Workflow Steals Cloud and AI Credentials from Tens of Thousands of Repositories

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5546 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GhostAction Malicious Security Audit Workflow Run — Exploitation

TL-2026-5546: Behaviour-first detection of the GhostAction injected GitHub Actions workflow (security-audit.yml / github_actions_security.yml / security-check.yml, job 'audit' or 'send-secrets') executing in GitHub audit logs. The workflow masquerades as a security audit, runs on any push or workflow_dispatch, and greps the tree and full git history for cloud and AI credentials before POSTing them to 193.32.204.199. A completed/successful run means the repository's secrets must be treated as stolen.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1036.005, T1078
• Data sources: github_audit_log
• Severity: high
• Confidence: high

Splunk SPL

index=github sourcetype IN ("github:cloud:audit","github:enterprise:audit") action IN ("workflows.created_workflow_run","workflows.completed_workflow_run","workflows.prepared_workflow_job") ("security-audit.yml" OR "github_actions_security.yml" OR "security-check.yml" OR name="Security Audit")
| fillnull value="unknown" repo actor
| stats count min(_time) AS first_seen max(_time) AS last_seen values(action) AS actions values(conclusion) AS conclusions values(head_branch) AS branches values(event) AS triggers by repo, actor
| eval likely_exfiltration=if(isnotnull(mvfind(conclusions,"success")),"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

GitHubAuditLogPolling_CL
| where TimeGenerated > ago(24h)
| where action_s in ("workflows.created_workflow_run", "workflows.completed_workflow_run", "workflows.prepared_workflow_job")
| extend raw = tostring(pack_all())
| where raw has_any ("security-audit.yml", "github_actions_security.yml", "security-check.yml") or raw has "Security Audit"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Runs = count() by Repo = repo_s, Actor = actor_s
| order by Runs desc

Sigma

title: GhostAction Malicious Security Audit Workflow Run (TL-2026-5546)
id: 3f2a9c1e-7b4d-4e6a-9a51-0c8d2e5f1a01
status: experimental
description: Detects GitHub Actions workflow runs of the GhostAction credential-stealing workflow (security-audit.yml, github_actions_security.yml, security-check.yml, display name Security Audit). Any completed run is treated as confirmed secret exfiltration.
references:
    - https://socket.dev/blog/ghostaction-cloud-credentials
    - https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/
    - https://www.stepsecurity.io/blog/ghostaction-returns
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.t1078
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: github
    service: audit
detection:
    selection_action:
        action:
            - 'workflows.created_workflow_run'
            - 'workflows.completed_workflow_run'
            - 'workflows.prepared_workflow_job'
    selection_name:
        name: 'Security Audit'
    selection_path:
        workflow_path|endswith:
            - '/security-audit.yml'
            - '/github_actions_security.yml'
            - '/security-check.yml'
    condition: selection_action and (selection_name or selection_path)
falsepositives:
    - Legitimate internal workflow that happens to be named Security Audit
    - Org-approved security-check.yml that predates the campaign
level: high

Known false positives:

• Legitimate internal workflow named Security Audit or security-check.yml that predates the campaign
• Security teams intentionally adding an org-approved audit workflow

Tuning notes: Allowlist known-good workflow paths and repositories after verifying their content hash. Confirm your Splunk GitHub audit sourcetype and field names (action, actor, repo, name, conclusion) and adjust. If workflow_path is not in your audit events the raw-text match on the file name still applies. Treat any hit with likely_exfiltration=yes as an incident and rotate/revoke all secrets the workflow references.

• 🔒 GhostAction Workflow Pushed Directly to Repository Under Victim Identity — Exploitation · unlock with TL Creds
• 🔒 GhostAction Automated Secret Exfiltration via curl POST — Post-Exploitation · unlock with TL Creds
• 🔒 GhostAction Plain-HTTP POST Exfiltration URL Pattern — C2 / Exfiltration · unlock with TL Creds
• 🔒 GhostAction Mass Workflow Injection Across Many Repositories — Exploitation · unlock with TL Creds
• 🔒 Cloud Credential Abuse After GhostAction Secret Theft — Post-Exploitation · unlock with TL Creds
• 🔒 Legacy GhostAction Exfiltration Domain DNS Lookups — C2 / Exfiltration · unlock with TL Creds
• 🔒 GhostAction Credential Scan of Source Tree and Git History — Post-Exploitation · unlock with TL Creds
• 🔒 GhostAction Exfiltration IP Network Connections — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 39 indicators of compromise for TL-2026-5546.

Sample indicators (3 of 39)

• IP address: 193.32.204[.]199
• Domain: bold-dhawan[.]45-139-104-115[.]plesk[.]page
• File hash: cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60

Defanged, TLP:CLEAR. Full set of 39 indicators: unlock with TL Creds.

Technical analysis

Socket saw 500+ committing accounts since 2026-10-07; GitGuardian counts 30,000+ repositories across about 3,000 users/orgs.

GhostAction is a GitHub Actions supply-chain campaign first documented by GitGuardian in September 2025 (817 repositories, 327 users, 3,325 secrets stolen; initial case a compromised FastUUID maintainer who pushed .github/workflows/github_actions_security.yml on 2025-09-02). The operator uses stolen GitHub credentials (PATs or sessions; the initial access method is not established by any source) to commit a workflow directly to repositories under the victim's identity. The workflow is disguised as a security audit but has no security function.

The October 2026 wave (v1-v3 payloads) triggers on any push to any branch or tag plus workflow_dispatch, checks out with fetch-depth: 0, hardcodes the names of Actions secrets that the repository's legitimate workflows already reference, and greps the working tree and `git log -p --all` for 13 credential regexes: AWS access key IDs, STS key IDs, secret access keys and session tokens; Anthropic, OpenAI project and OpenRouter keys; GitHub classic and fine-grained PATs and GitLab PATs; Google/Firebase/GCP API keys, Slack tokens and SendGrid keys. Two lines of context around AKIA/ASIA key IDs are captured to pair IDs with secret keys (markers AKIA_CTX_START / AKIA_CTX_END). Everything is appended into one variable and sent in a single curl POST (20 s timeout, errors suppressed with `|| true`) in plain HTTP to the raw IP 193.32.204.199 (path /?c=<tag>, e.g. monami, new, bling, blingnew, mnsft, security), so no DNS lookup occurs. The server returns a repository identifier on every run, giving the operator a map of reachable repositories. The workflow's GITHUB_TOKEN is read-only (contents: read), so escalation depends on stolen secrets.

Timeline and scale: an Aug 31 - Sept 30, 2026 wave injected workflows into 772 repositories using the same IP. On 2026-10-08 the compromised accounts kitao (27 repos incl. kitao/pyxel, 18,420 stars, published to PyPI and crates.io) and henrywoo (318 repos, 39 source + 279 forks, incl. uber/athenadriver) were swept within minutes (346 repositories total per Socket). GitGuardian reports a burst of about 28,000 new repositories within ~20 minutes on Oct 8-9 and an overall 30,000+ repositories across ~3,000 users/orgs from ~1,900 compromised accounts, attempting 3,174 secrets; Socket counts 500+ committing accounts since Oct 7. GitHub began blocking the workflow from running on 2026-10-09; the Oct 10 and 12 waves used the same payload but could not extract secrets. In earlier waves, GitHub approval gating for workflow runs also stopped many executions. No malicious package releases from stolen publishing tokens had been observed at the time of Socket's writing.

Attribution: no source names an actor. Socket describes the operator as tool-driven (template-generated payload, mass deployed). GitGuardian notes the actor reuses unrotated secrets from earlier waves, that GitHub credentials are not exclusive to one actor (leaked tokens and infostealer logs are reused), that at least four separate cryptomining campaigns hit 13 GhostAction victim repos, and that a separate XMRig commit in kuafuai/DevOpsGPT is probably not the same operator. Hunting and response: search workflows for AKIA_CTX_START, c=monami and 193.32.204.199; review direct default-branch commits adding workflow files; treat any completed run as confirmed exfiltration; rotate all named secrets, revoke (not just rotate) PATs and the credential used for injection.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213.003 Data from Information Repositories: Code Repositories

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1550.001 Use Alternate Authentication Material: Application Access Token

Persistence

T1053.003 Scheduled Task/Job: Cron

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1078 Valid Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.002 Phishing: Spearphishing Link

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys

Resource Development

T1583.001 Acquire Infrastructure: Domains

Remediation

Immediate actions

• Search all org repositories and forks (all branches) for .github/workflows/security-audit.yml, github_actions_security.yml and security-check.yml and the strings AKIA_CTX_START, c=monami and 193.32.204.199; remove and revert the injecting commits
• Treat any completed run of the injected workflow as confirmed exfiltration; rotate every secret named in the file and every credential ever committed to any branch
• Revoke (do not merely rotate) exposed personal access tokens and the GitHub credential/session used for injection; revoke OAuth grants and SSH keys of affected accounts
• Block and hunt for 193.32.204.199 (ports 80 and 3000) in egress logs, including self-hosted runners
• Review CloudTrail for new IAM users, access keys and unusual regions; review PyPI, npm, crates.io and container registry release history for unexpected versions

Workarounds

• Check forks of affected namespaces (e.g. henrywoo) for the workflow file before enabling Actions
• Pause package releases until publishing tokens are rotated

Longer-term hardening

• Enforce phishing-resistant MFA for maintainers and re-enroll affected accounts
• Enable secret scanning with push protection
• Protect .github/workflows/* with branch protection / CODEOWNERS so workflow changes require pull request review
• Require approval for workflow runs from outside collaborators and restrict runner egress with an allowlist (e.g. Harden-Runner allowed-endpoints)
• Use environment-scoped, least-privilege secrets and short-lived OIDC credentials instead of long-lived keys

Affected and fixed versions

• GitHub — GitHub Actions workflows in public repositories with write access held by compromised maintainer accounts
  Vulnerable versions: Repositories where a compromised account can push workflow files to the default branch
• kitao — kitao/pyxel (PyPI and crates.io publishing secrets targeted)
  Vulnerable versions: Repository state as of 2026-10-08
• Uber — uber/athenadriver (workflow committed via henrywoo write access)
  Vulnerable versions: Repository state as of 2026-10-08

Timeline

Last updated 2026-11-09 · 2 updates · revalidated 2× · latest source

• 2025-09-02 Original GhostAction: compromised FastUUID maintainer pushes the first malicious github_actions_security.yml commit; the 2025 campaign ultimately hit 817 repositories, 327 users and 3,325 secrets (GitGuardian).
• 2025-09-05 GitGuardian identifies the injected workflow and notifies GitHub, npm and PyPI; PyPI makes the project read-only and the exfiltration hostname stops resolving.
• 2026-08-31 Wave using plain-HTTP exfiltration to locked-ioc-20 begins; 772 repositories receive workflows through 2026-09-30 (bursts Aug 31, Sept 2-5, Sept 15).
• 2026-09-04 StepSecurity honeypot records the earliest hit on the current C2 endpoint locked-ioc-20; the earliest infected repository carrying it dates to 2026-09-05.
• 2026-09-05 Peak of the Aug-Sept wave: 294 repositories injected in one day; typecho-fans/plugins compromised via account xxyangyoulin.
• 2026-09-07 Smaller variant in 7 repositories posts to locked-ioc-5?inj=<id> (GitGuardian).
• 2026-10-07 GitGuardian reports the 2026 wave: 772 public repos, 373 users/orgs, 2,577 targeted secrets; only 16% of repos cleaned as of Oct 5.
• 2026-10-07 Earliest commits of the expanded security-audit.yml workflow identified by Socket; 500+ accounts later seen committing it.
• 2026-10-08 Mass injection with git-history-scanning payload: ~1,713 commits from 12:26 UTC, then batches tagged bling/blingnew/monami/new; ~29,431 commits in the 'new' batch from 14:07 UTC. The uber/athenadriver run delivered data with a server 'OK' response at 21:26:04Z.
• 2026-10-08 Compromised accounts kitao (13:40-13:44Z, 27 repos incl. kitao/pyxel) and henrywoo (21:10-21:26Z, 318 repos incl. uber/athenadriver) sweep 346 repositories; the workflow runs and exfiltrates.
• 2026-10-09 locked-ioc-22 is registered and resolves to the C2 IP; OpenSourceMalware counts 790 repositories. The workflow remains on default branches of kitao/pyxel and uber/athenadriver.
• 2026-10-09 Burst of ~28,000 new repositories (GitGuardian total 30,000+ repos, ~3,000 users/orgs, ~1,900 compromised accounts); GitHub begins blocking the workflow from running; Socket publishes analysis.
• 2026-10-10 Further waves on Oct 10 and 12 reuse the payload but cannot extract secrets because of GitHub's block.
• 2026-10-11 Reverse-proxy phishing kit on locked-ioc-22 obtains an OAuth device-flow grant (repo workflow read:org) to regain access to victim accounts and re-inject repositories (per Corgea citing OpenSourceMalware).
• 2026-10-13 GitGuardian updates scale to ~30,000+ repos, ~3,000 users/orgs, ~1,900 compromised accounts and 3,174 targeted secrets.
• 2026-10-14 Stage 2 begins: a second workflow, the locked-ioc-16 Node.js stealer and a locked-ioc-19 folderOpen task are committed; peak of 7,653 'Add font assets' commits on 2026-10-15; exfiltration moves to port 8080.
• 2026-10-20 github_actions_security.yml rewritten with id-token: write and an AWS AssumeRoleWithWebIdentity loop (batch tags og1, og2, oidc_og2); activity continues through 2026-10-21. Actual AWS role compromise not confirmed.
• 2026-11-09 GBHackers publishes coverage of the campaign and mitigation guidance.

Update history

• 2026-11-09 — GhostAction: 500+ Compromised GitHub Accounts Inject Fake security-audit.yml Workflow to Steal Cloud, AI and Publishing Credentials: What changed No field escalation applied. Severity stays HIGH and exploitability stays ACTIVE: the report adds stage-2 and OIDC capability but states AWS role compromise was not confirmed and no malicious package releases were observed.
• 2026-11-09 — GhostAction Variant: Malicious 'security-audit.yml' GitHub Actions Workflow Compromises Tens of Thousands of Repositories: What changed No severity, exploitability, status or attribution change; HIGH / ACTIVE / Unattributed (LOW confidence) stand. Record is enriched with additional indicators, techniques and timeline detail.

Sources cited

• Socket - New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials socket.dev · Research · 2026-10-09
• GitGuardian - GhostAction GitHub Actions supply chain attack returns blog.gitguardian.com · Research
• GitGuardian - GhostAction Campaign: 3,325 secrets stolen blog.gitguardian.com · Research · 2025-09-05
• StepSecurity - GhostAction Returns stepsecurity.io · Research · 2026-10-09
• Cloud Security Alliance - Research note: GitHub Actions workflow credential theft labs.cloudsecurityalliance.org · Research · 2026-10-12
• Start With Identity - GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos startwithidentity.com · Blog · 2026-10-15
• GBHackers - GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials gbhackers.com · News · 2026-11-09

Related threats

• GhostAction: Credential-Stealing GitHub Actions Workflows Planted in Compromised Maintainer Repositories
• GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories
• Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)

Previous and next in supply chain

• GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp 0.2.21 Beside DPRK-Linked PolinRider Campaign Previous report
• Malicious @ethersphere/bee-js 13.3.0 npm Release and Swarm Desktop 0.56.2 Deliver SleepyDuck Ethereum C2 Backdoor Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages