What happened

The GhostAction campaign returned in October 2026. Attackers got write access to GitHub accounts and pushed a GitHub Actions workflow disguised as a security improvement, with names like Security Audit. When it runs, it sends repository secrets and cloud, AI and SaaS credentials to a hardcoded IP address, 193.32.204.199, over plain HTTP. The sources give the likely access routes as stolen personal access tokens or credentials from infostealer logs and dumps. StepSecurity called leaked tokens the most plausible route, which is not confirmed.

The new payload also searches the working tree and the full git history, so a secret deleted long ago can still be taken. Targets include AWS key IDs, GitHub and GitLab tokens, AI provider keys and cloud API keys.

Counts depend on who measured what. StepSecurity followed two hijacked maintainer accounts that pushed the workflow to 345 repositories on October 8, and found 378 repositories with a live copy by October 9. GitGuardian's wider dataset puts the total at more than 30,000 targeted repositories across about 3,000 users and organizations, from about 1,900 compromised accounts.

StepSecurity confirmed exfiltration from the uber/athenadriver run. In typecho-fans/plugins, a required approval for workflow runs stopped a re-trigger. The workflow's GITHUB_TOKEN was read-only, so it could not push or publish itself. No malicious package releases from the stolen publishing credentials had been seen when StepSecurity wrote.

GitHub began preventing the malicious workflow from running on October 9, so later waves could not extract secrets. Secrets already sent stay stolen. Some victims had been hit in earlier waves, which suggests attackers reuse secrets that were never rotated.

Timeline

  1. The new GhostAction wave started, around 2 pm GMT.[2]

  2. First observed campaign use of the current exfiltration IP, in an infected repository (typecho-fans/plugins).[1]

  3. A compromised maintainer account pushed the malicious workflow to pyxel, starting a sweep of 27 repositories.[1]

  4. A second compromised account began pushing the workflow to 318 repositories in a 16-minute window.[1]

  5. The attacker server acknowledged a POST in the uber/athenadriver run, confirming exfiltration.[1]

  6. GitHub started preventing the malicious workflow from running.[3]

  7. New waves with the same payload were seen but could not extract secrets.[3]

Who is affected

  • Maintainers of GitHub repositories whose account or token was used to push the workflow, and anyone whose repositories ran it.
  • Repositories with a security-audit.yml or github_actions_security.yml workflow since August 31, 2026 should be treated as confirmed breaches.
  • Forks of infected repositories carry the workflow and can leak data if Actions is enabled.
  • Repositories with package publishing secrets, because an attacker could publish as them.
  • Victims from earlier waves who never rotated their secrets.

How to check

  1. Look in the repositories you maintain, including local clones after fetching, for workflow files named security-audit.yml, github_actions_security.yml or security-check.yml.
  2. Search your repositories and organization on GitHub for the address 193.32.204.199 in workflow files.
  3. Review your GitHub security log and recent commits for pushes you did not make, such as ones titled Add security audit workflow.
  4. Check Actions run history since August 31, 2026 for runs of the suspicious workflow; completed runs should be treated as exfiltration.
  5. If your Mac ever ran an infostealer, treat GitHub tokens stored on it as exposed.

What to do

  1. Find and revoke the GitHub credential that made the injection. Rotating repository secrets alone is not enough.
  2. Rotate all Actions secrets and every credential ever committed to any branch.
  3. Delete the malicious workflow from all branches and forks.
  4. Do not cut releases until the repository is clean and credentials are rotated.
  5. Require approval for workflow runs and protect workflow files with branch protection and pull-request review.

Indicators of compromise

Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.

TypeIndicatorNoteCopy
IP and port193[.]32[.]204[.]199:3000C2 exfiltration endpoint (port 3000)[1]
IP address193[.]32[.]204[.]199C2 IP used for exfiltration[1]
URLhxxp://193[.]32[.]204[.]199/?c=monamiExfil URL for repositories with named secrets[1]
File path.github/workflows/security-audit.ymlMalicious workflow filename[1]
OtherAKIA_CTX_STARTMarker in POST body for AWS context capture[1]
OtherAKIA_CTX_ENDMarker in POST body for AWS context capture[1]
IP address45[.]139[.]104[.]115Legacy C2 IP from prior wave[1]
IP address170[.]39[.]218[.]2Legacy C2 IP from prior wave[1]
OtherAdd security audit workflowInjected commit message[1]
OtherTrigger security scanRe-trigger commit message[1]
Domainbold-dhawan[.]45-139-104-115[.]plesk[.]pageExfiltration endpoint used in the September 2025 wave[2]
Domaincarte-avantage[.]comExfiltration endpoint used in the 2025 wave[2]
Domainobjective-hopper[.]45-139-104-115[.]plesk[.]pageExfiltration endpoint in September 2025[2]
URLhxxp://193[.]32[.]204[.]199/?c=blingExfiltration URL for the bling-tagged batch[2]
URLhxxp://193[.]32[.]204[.]199/?c=blingnewExfiltration URL for the blingnew-tagged batch[2]
File pathgithub_actions_security.ymlMalicious workflow file name disguised as GitHub Actions Security[3]

Sources

Changelog

  1. First published.