A campaign dubbed GhostAction has compromised more than 500 GitHub accounts and injected malicious workflows into repositories to harvest cloud and AI API keys, according to research from Socket. Reporting says the injected workflows span tens of thousands of repositories, and the campaign has been expanding since October 7.
Injected security-audit.yml Workflow Harvests Secrets
The attackers push a file named .github/workflows/security-audit.yml. The workflow runs on every push and can also be triggered manually, and its job is to collect secrets available to GitHub Actions.
The name is chosen to look routine. A workflow labeled as a security audit may draw less scrutiny from a maintainer scanning a repository’s workflow directory.
Secrets Targeted: Cloud, AI, Source Control and Package Registries
The list of targeted secrets is broad. It covers GitHub Actions secrets, AWS keys and tokens, and Anthropic, OpenAI and OpenRouter API keys. It also includes GitHub and GitLab tokens, Google and Slack credentials, SendGrid keys, and PyPI and cargo tokens.
That mix spans cloud infrastructure, AI services, code hosting, messaging, email delivery and package publishing. Stolen CI/CD secrets can enable downstream package and cloud compromise, which is the main impact described.
Timeline: October 7 Expansion and the October 8 Burst
Socket’s analysis puts the expansion of the campaign at October 7. An initial burst on October 8 hit 346 repositories. Socket issued an update on October 9, and coverage of the findings was published on October 10. The campaign remains ongoing, and the account and repository totals have grown since the first reports.
Named Projects and the Exfiltration Endpoint
Affected projects named in the reporting include uber/athenadriver and kitao/pyxel. The exfiltration endpoint is 193.32.204[.]199.
Socket found no malicious package releases tied to the campaign. The documented theft is of credentials, and the reporting does not describe any tampered packages published as a result so far.
Scope: 500+ Accounts and Tens of Thousands of Repositories
The number of compromised accounts exceeds 500. The figure for repositories, in the tens of thousands, is described as reported rather than independently confirmed, so it should be read as an estimate of how widely the workflows were injected.
The first burst of 346 repositories gives a firmer data point on the pace of the campaign: a single day’s activity touched hundreds of repositories, and the work continued afterward.
Response: Audit Workflow Files and Rotate Secrets
Socket documented indicators of compromise for the campaign. The guidance for maintainers is to audit their workflow files for the unauthorized security-audit.yml entry and to rotate any secrets that were available to Actions.
The reporting does not explain how the 500-plus accounts were compromised in the first place. It also does not identify the operators. What is documented is the mechanism once access is obtained: a workflow file that executes automatically on each push and sends secrets to a fixed external address.
Because the workflow can run on every push, any secret present in a repository’s Actions configuration at the time of a push is potentially exposed, including tokens that provide access to publishing channels such as PyPI and cargo. The absence of malicious package releases so far leaves open what the operators intend to do with the stolen tokens.
Why Workflow Files Are an Effective Theft Route
GitHub Actions workflows execute inside a repository’s automation environment, where secrets configured for the repository are available to the job. A workflow that is committed by a compromised account therefore runs with access to those secrets, and the security-audit.yml file described by Socket is designed to collect them.
Manual Trigger Lets Operators Collect Secrets on Demand
The manual-trigger option matters as well. Besides running on every push, the workflow can be started on demand, so the operators do not depend on a legitimate maintainer pushing new code before they can collect secrets.
The targeted credentials are those that open further doors: AWS keys and tokens for cloud accounts, Anthropic, OpenAI and OpenRouter keys for AI services, GitHub and GitLab tokens for source control, and PyPI and cargo tokens for publishing packages. Socket’s finding that no malicious package releases are tied to the campaign means the documented harm to date is credential theft, with the downstream risk lying in what the stolen tokens can later be used for.
