# GhostAction Supply Chain Campaign Expands: Malicious GitHub Actions Workflow Steals Cloud and AI Credentials from Tens of Thousands of Repositories

> A new wave of the GhostAction campaign pushed a credential-stealing GitHub Actions workflow (security-audit.yml) into tens of thousands of repositories via compromised maintainer accounts. Unlike earlier waves, it also scans source code and full git history for 13 classes of cloud and AI credentials and POSTs them over plain HTTP to 193.32.204.199. Socket saw 500+ committing accounts since 2026-10-07; GitGuardian counts 30,000+ repositories across about 3,000 users/orgs.

- **Published:** 2026-11-09T11:45:24Z
- **Last reviewed:** 2026-11-09T17:05:26.980Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5546
- **ID:** TL-2026-5546
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 39 (3 shown free below)

## Description

GhostAction is a GitHub Actions supply-chain campaign first documented by GitGuardian in September 2025 (817 repositories, 327 users, 3,325 secrets stolen; initial case a compromised FastUUID maintainer who pushed .github/workflows/github_actions_security.yml on 2025-09-02). The operator uses stolen GitHub credentials (PATs or sessions; the initial access method is not established by any source) to commit a workflow directly to repositories under the victim's identity. The workflow is disguised as a security audit but has no security function.

The October 2026 wave (v1-v3 payloads) triggers on any push to any branch or tag plus workflow_dispatch, checks out with fetch-depth: 0, hardcodes the names of Actions secrets that the repository's legitimate workflows already reference, and greps the working tree and `git log -p --all` for 13 credential regexes: AWS access key IDs, STS key IDs, secret access keys and session tokens; Anthropic, OpenAI project and OpenRouter keys; GitHub classic and fine-grained PATs and GitLab PATs; Google/Firebase/GCP API keys, Slack tokens and SendGrid keys. Two lines of context around AKIA/ASIA key IDs are captured to pair IDs with secret keys (markers AKIA_CTX_START / AKIA_CTX_END). Everything is appended into one variable and sent in a single curl POST (20 s timeout, errors suppressed with `|| true`) in plain HTTP to the raw IP 193.32.204.199 (path /?c=<tag>, e.g. monami, new, bling, blingnew, mnsft, security), so no DNS lookup occurs. The server returns a repository identifier on every run, giving the operator a map of reachable repositories. The workflow's GITHUB_TOKEN is read-only (contents: read), so escalation depends on stolen secrets.

Timeline and scale: an Aug 31 - Sept 30, 2026 wave injected workflows into 772 repositories using the same IP. On 2026-10-08 the compromised accounts kitao (27 repos incl. kitao/pyxel, 18,420 stars, published to PyPI and crates.io) and henrywoo (318 repos, 39 source + 279 forks, incl. uber/athenadriver) were swept within minutes (346 repositories total per Socket). GitGuardian reports a burst of about 28,000 new repositories within ~20 minutes on Oct 8-9 and an overall 30,000+ repositories across ~3,000 users/orgs from ~1,900 compromised accounts, attempting 3,174 secrets; Socket counts 500+ committing accounts since Oct 7. GitHub began blocking the workflow from running on 2026-10-09; the Oct 10 and 12 waves used the same payload but could not extract secrets. In earlier waves, GitHub approval gating for workflow runs also stopped many executions. No malicious package releases from stolen publishing tokens had been observed at the time of Socket's writing.

Attribution: no source names an actor. Socket describes the operator as tool-driven (template-generated payload, mass deployed). GitGuardian notes the actor reuses unrotated secrets from earlier waves, that GitHub credentials are not exclusive to one actor (leaked tokens and infostealer logs are reused), that at least four separate cryptomining campaigns hit 13 GhostAction victim repos, and that a separate XMRig commit in kuafuai/DevOpsGPT is probably not the same operator. Hunting and response: search workflows for AKIA_CTX_START, c=monami and 193.32.204.199; review direct default-branch commits adding workflow files; treat any completed run as confirmed exfiltration; rotate all named secrets, revoke (not just rotate) PATs and the credential used for injection.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1213.003 Data from Information Repositories: Code Repositories
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1020 Automated Exfiltration
- T1005 Data from Local System
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1566.002 Phishing: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1053.003 Scheduled Task/Job: Cron
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1552.004 Unsecured Credentials: Private Keys
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GhostAction Malicious Security Audit Workflow Run — Exploitation** (`TL-2026-5546-SPL-001`)

TL-2026-5546: Behaviour-first detection of the GhostAction injected GitHub Actions workflow (security-audit.yml / github_actions_security.yml / security-check.yml, job 'audit' or 'send-secrets') executing in GitHub audit logs. The workflow masquerades as a security audit, runs on any push or workflow_dispatch, and greps the tree and full git history for cloud and AI credentials before POSTing them to 193.32.204.199. A completed/successful run means the repository's secrets must be treated as stolen.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1036.005, T1078
- **Data sources:** github_audit_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=github sourcetype IN ("github:cloud:audit","github:enterprise:audit") action IN ("workflows.created_workflow_run","workflows.completed_workflow_run","workflows.prepared_workflow_job") ("security-audit.yml" OR "github_actions_security.yml" OR "security-check.yml" OR name="Security Audit")
| fillnull value="unknown" repo actor
| stats count min(_time) AS first_seen max(_time) AS last_seen values(action) AS actions values(conclusion) AS conclusions values(head_branch) AS branches values(event) AS triggers by repo, actor
| eval likely_exfiltration=if(isnotnull(mvfind(conclusions,"success")),"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| sort - count
```

### Microsoft KQL

```kql
GitHubAuditLogPolling_CL
| where TimeGenerated > ago(24h)
| where action_s in ("workflows.created_workflow_run", "workflows.completed_workflow_run", "workflows.prepared_workflow_job")
| extend raw = tostring(pack_all())
| where raw has_any ("security-audit.yml", "github_actions_security.yml", "security-check.yml") or raw has "Security Audit"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Runs = count() by Repo = repo_s, Actor = actor_s
| order by Runs desc
```

### Sigma

```yaml
title: GhostAction Malicious Security Audit Workflow Run (TL-2026-5546)
id: 3f2a9c1e-7b4d-4e6a-9a51-0c8d2e5f1a01
status: experimental
description: Detects GitHub Actions workflow runs of the GhostAction credential-stealing workflow (security-audit.yml, github_actions_security.yml, security-check.yml, display name Security Audit). Any completed run is treated as confirmed secret exfiltration.
references:
    - https://socket.dev/blog/ghostaction-cloud-credentials
    - https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/
    - https://www.stepsecurity.io/blog/ghostaction-returns
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.t1078
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: github
    service: audit
detection:
    selection_action:
        action:
            - 'workflows.created_workflow_run'
            - 'workflows.completed_workflow_run'
            - 'workflows.prepared_workflow_job'
    selection_name:
        name: 'Security Audit'
    selection_path:
        workflow_path|endswith:
            - '/security-audit.yml'
            - '/github_actions_security.yml'
            - '/security-check.yml'
    condition: selection_action and (selection_name or selection_path)
falsepositives:
    - Legitimate internal workflow that happens to be named Security Audit
    - Org-approved security-check.yml that predates the campaign
level: high

```

**Known false positives:**

- Legitimate internal workflow named Security Audit or security-check.yml that predates the campaign
- Security teams intentionally adding an org-approved audit workflow

**Tuning notes:** Allowlist known-good workflow paths and repositories after verifying their content hash. Confirm your Splunk GitHub audit sourcetype and field names (action, actor, repo, name, conclusion) and adjust. If workflow_path is not in your audit events the raw-text match on the file name still applies. Treat any hit with likely_exfiltration=yes as an incident and rotate/revoke all secrets the workflow references.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GhostAction Workflow Pushed Directly to Repository Under Victim Identity — Exploitation (locked: unlock with TL Creds)
- GhostAction Automated Secret Exfiltration via curl POST — Post-Exploitation (locked: unlock with TL Creds)
- GhostAction Plain-HTTP POST Exfiltration URL Pattern — C2 / Exfiltration (locked: unlock with TL Creds)
- GhostAction Mass Workflow Injection Across Many Repositories — Exploitation (locked: unlock with TL Creds)
- Cloud Credential Abuse After GhostAction Secret Theft — Post-Exploitation (locked: unlock with TL Creds)
- Legacy GhostAction Exfiltration Domain DNS Lookups — C2 / Exfiltration (locked: unlock with TL Creds)
- GhostAction Credential Scan of Source Tree and Git History — Post-Exploitation (locked: unlock with TL Creds)
- GhostAction Exfiltration IP Network Connections — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 39)

Defanged, TLP:CLEAR.

- IP address: `193.32.204[.]199`
- Domain: `bold-dhawan[.]45-139-104-115[.]plesk[.]page`
- File hash: `cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60`

Full set of 39 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GBHackers - GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials](https://gbhackers.com/ghostaction-supply-chain/)
- [Socket - New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials](https://socket.dev/blog/ghostaction-cloud-credentials)
- [GitGuardian - GhostAction GitHub Actions supply chain attack returns](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/)
- [GitGuardian - GhostAction Campaign: 3,325 secrets stolen](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/)
- [StepSecurity - GhostAction Returns](https://www.stepsecurity.io/blog/ghostaction-returns)
- [Cloud Security Alliance - Research note: GitHub Actions workflow credential theft](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/10/CSA_research_note_github_actions_workflow_credential_theft_20261012-csa-styled.pdf)
- [Start With Identity - GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos](https://startwithidentity.com/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5546