Repositórios e GitHub Actions · Exploitation confirmed

GhostAction: 22,964 Repositories Targeted, 1,792 Accounts Compromised, Stolen Tokens Reused

Oct 07, 2026 · 2 min read

GhostAction compromises GitHub maintainer accounts to inject fake workflows that steal Actions secrets and credentials from the entire git history. Researchers now count 22,964 targeted repositories, more than 72,000 malicious commits and 1,792 compromised accounts, with five payload families and stolen tokens still being reused, The Hacker News reports. There is no patch: revoke tokens and secrets, remove the malicious files and treat their presence as a confirmed breach.

By HIFY Radar newsroom Updated 10/28/2026 08:22 AM Get this every day →← Back to the feed 6 sources

HighSupply chainExploitation confirmedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Sustained attacks compromised GitHub developer accounts and used that access to inject malicious automation workflows into thousands of repositories, stealing passwords and cloud access keys. Researchers cited by The Hacker News raised the totals: 22,964 targeted repositories, more than 72,000 malicious commits and 1,792 compromised accounts, with five payload families. A second stage hits the developer's machine through VS Code, steals credentials and installs remote execution of attacker commands every five minutes.

Why it matters

Every credential configured in the repository and any password committed to the git history, even ones later removed, was offered to the attacker, according to StepSecurity, which says the malicious file's presence means a confirmed breach. Uber's athenadriver repository and the pyxel project were hit, and The Hacker News reports stolen tokens are still being reused. Stolen package publishing credentials would allow shipping fake releases of trusted software, affecting everyone who depends on it.

What to do

Immediately revoke all tokens, keys and passwords for repositories reachable by compromised accounts, including anything found in git history. Order removal of the malicious files (security-audit.yml, github_actions_security.yml.vscode/tasks.json and public/fonts/fa-solid-400.woff2) and hunting for published indicators such as IP 193.32.204.199 and the AKIA_CTX_START marker. Treat every finding as a confirmed breach and inspect developer machines.

For the technical team

Affected: Repositórios e GitHub Actions (campanha GhostAction; 22.964 repositórios visados, 72.000+ commits maliciosos, 1.792 contas comprometidas, 5 famílias de payload) · Repositories where compromised accounts had write access; no GitHub product flaw. October 8, 2026 wave: 346 repositories including uber/athenadriver and kitao/pyxel, with 318 under henrywoo (39 source and 279 forks) and 27 under kitao (Socket); GitGuardian dates the wave October 8 to 12, 2026. Second stage: 1,279 repositories owned by 411 accounts as of October 26, with 1,230 carrying the full set and 114 lacking the Stage 1 workflow (OpenSourceMalware). Campaign totals per The Hacker News: 22,964 repositories and 1,792 accounts.
Exploitation: Active and confirmed exploitation at scale. The uber/athenadriver run log shows the attacker's server acknowledging receipt 4 seconds after the workflow started (StepSecurity). Socket identified more than 500 accounts committing the workflow to tens of thousands of repositories since October 7, 2026, including organization-owned ones. The Hacker News: stolen tokens are still being reused. Socket observed no malicious packages published to PyPI or crates.io as of October 9, 2026. On October 9 the workflow remained on the default branch of uber/athenadriver and kitao/pyxel.
Fix: No product patch. Revoke all exposed tokens and secrets, including credentials present in git history, and remove .github/workflows/security-audit.yml.github/workflows/github_actions_security.yml.vscode/tasks.json and public/fonts/fa-solid-400.woff2. Remove the #ghc2 cron job from developer machines. StepSecurity: any Security Audit or Github Actions Security workflow appearing since August 31, 2026 must be treated as a confirmed breach, as it beacons on every run even when it finds nothing. Published queries at github.com/search: 'AKIA_CTX_START' path:.github/workflows, 'c=monami', '193.32.204.199' path:.github/workflows, plus org: variants.
Vector: Maintainer account compromise, most plausibly personal access tokens leaked in infostealer logs (StepSecurity), followed by a direct commit to the default branch, no PR or review, of fake workflows (security-audit.yml, github_actions_security.yml) that run on every unfiltered push and via workflow_dispatch. The workflow collects the repository's named Actions secrets (exact names templated after reconnaissance), sweeps the working tree and the entire git history (fetch-depth: 0, 13 credential patterns, AWS AKIA/ASIA key context) and sends everything in a single POST over plain HTTP to a hardcoded IP. Second stage: .vscode/tasks.json with runOn folderOpen runs node ./public/fonts/fa-solid-400.woff2, a fake font file in Node.js that reads eight credential files (.aws/credentials.pypirc.npmrc.git-credentials.netrc.claude/.credentials.json.gemini/oauth_creds.json.kube/config), full SSH keys id_rsa and id_ed25519, AWS_, ANTHROPIC, OPENAI, HF_TOKEN and GITHUB_TOKEN environment variables, and installs a cron job that downloads and runs attacker commands every five minutes.
More details: Four-stage chain: account compromise, reconnaissance of exact secret names used in workflows, direct injection to the default branch under the victim's legitimate identity (unsigned commits, message 'Add security audit workflow') and exfiltration via curl over plain HTTP. The exfiltration endpoint moved from the September 2025 domains (45.139.104.115) to IP 193.32.204.199, observed in the campaign since at least September 4, 2026 and in honeypot records one day earlier. The original campaign, covered by StepSecurity in September 2025, stole more than 3,000 secrets across 817 repositories belonging to 327 developers. The VS Code second stage copies a technique from the PolinRider campaign, attributed to North Korea and discovered by Thijs Xhaflaire (Jamf Threat Labs) in January 2026; with no shared IOCs with DPRK malware, OpenSourceMalware labels it a copycat.

Indicators (IoCs)

193.32.204.199:3000/api/workflow/receive?inj=<id>
AKIA_CTX_START
c=monami
.github/workflows/security-audit.yml
public/fonts/fa-solid-400.woff2
bold-dhawan.45-139-104-115.plesk.page
carte-avantage.com
45.139.104.115

Timeline

10/28/2026 08:22 AM
Researchers raise the campaign's scale: 22,964 targeted repos, 72,000+ malicious commits, and 1,792 compromised accounts.
10/26/2026 01:34 PM
GitGuardian documents a new GhostAction wave hitting hundreds of repos.