GhostAction operators hacked the accounts of two GitHub developers and in a few hours introduced malicious scenarios in at least 345 repositories. The scripts stole tokens and keys from GitHub Actions, and the new version at the same time combed the entire history of the project, so even the credentials that the developers have long removed from the current code have been threatened.
The attack took place in two fast waves on October 8. At first, the criminals used the Takashi Kitao developer account and added a malicious file in 27 repositories. After about eight hours, the Henry Wu account sent the same scenario to 318 more projects. The whole second series took about 16 minutes.
Attackers did not have to create merger requests and wait for code verification. They worked through real developer accounts and sent changes directly to the main branches. For example, the saved Henry Wu rights allowed you to add a malicious file to the uber/athenadriver on behalf of a legitimate project participant.
The malicious script was given a harmless name security-audit.yml and gave himself up for security checks. After the launch, he took the secrets of GitHub Actions, that is, tokens, keys and other credentials, which automatic tasks use to access external services. The program then downloaded the full Git story and searched for additional keys in old changes, branches and tags.
Such a search greatly expands the possible damage. If the developer once accidentally added the API key to the repository, and the next change deleted it, the string could still survive in the history of Git. GhostAction is specifically looking for such traces. The target list includes AWS keys, GitHub and GitLab tokens, Google and Firebase credentials, Slack and SendGrid tokens, and Anthropic, OpenAI and OpenRouter API keys.
The search was sent by the usual HTTP request to the IP address 193.32.204.199. The uber/athenadriver launch log confirms that the attackers’ server took the shipment four seconds after the start of execution. The fact of the transfer does not yet show how many suitable keys were in a particular repository, but confirms that the malicious code has successfully worked.
In the project pyxel the script was launched five times. Three launches caused changes that the offender sent through the captured account, two other intruders launched manually. Among the targets were the PyPI and crates.io packages and the GitHub personal token. At the time of the analysis, the researchers did not find malicious releases of packages published with the help of stolen keys.
By October 9, the search for GitHub found a malicious scenario in the main branches of 378 repositories. The number does not show the full scale of the campaign: the search does not take into account part of the forks, and the owners of infected projects gradually delete malicious files. Therefore, researchers continue to clarify the number of victims.
GhostAction has been working for more than a year and refers to supply chain attacks, where access to the developer helps to get to the code, assembly infrastructure and project credentials. In September 2025, the criminals reached 817 repositories and stole at least 3,325 secrets. The new activity was not limited to the October wave: from August 31 to September 30, 2026, the researchers found 772 repositories, where the attackers added a previous version of the malicious script.
How criminals initially gain control over developer accounts is not yet established. The researchers allow the use of previously stolen access tokens or credentials from databases collected by password thaws, but there is no direct evidence of a specific way of hacking for the current wave.
Owners of affected projects are advised to remove malicious scenarios from all branches, check the history of GitHub Actions launches and withdraw credentials that allowed criminals to log in to the account. One replacement for current secrets is now not enough: if the key has ever been in the history of the repository, it should also be considered compromised and replaced.
The attack took place in two fast waves on October 8. At first, the criminals used the Takashi Kitao developer account and added a malicious file in 27 repositories. After about eight hours, the Henry Wu account sent the same scenario to 318 more projects. The whole second series took about 16 minutes.
Attackers did not have to create merger requests and wait for code verification. They worked through real developer accounts and sent changes directly to the main branches. For example, the saved Henry Wu rights allowed you to add a malicious file to the uber/athenadriver on behalf of a legitimate project participant.
The malicious script was given a harmless name security-audit.yml and gave himself up for security checks. After the launch, he took the secrets of GitHub Actions, that is, tokens, keys and other credentials, which automatic tasks use to access external services. The program then downloaded the full Git story and searched for additional keys in old changes, branches and tags.
Such a search greatly expands the possible damage. If the developer once accidentally added the API key to the repository, and the next change deleted it, the string could still survive in the history of Git. GhostAction is specifically looking for such traces. The target list includes AWS keys, GitHub and GitLab tokens, Google and Firebase credentials, Slack and SendGrid tokens, and Anthropic, OpenAI and OpenRouter API keys.
The search was sent by the usual HTTP request to the IP address 193.32.204.199. The uber/athenadriver launch log confirms that the attackers’ server took the shipment four seconds after the start of execution. The fact of the transfer does not yet show how many suitable keys were in a particular repository, but confirms that the malicious code has successfully worked.
In the project pyxel the script was launched five times. Three launches caused changes that the offender sent through the captured account, two other intruders launched manually. Among the targets were the PyPI and crates.io packages and the GitHub personal token. At the time of the analysis, the researchers did not find malicious releases of packages published with the help of stolen keys.
By October 9, the search for GitHub found a malicious scenario in the main branches of 378 repositories. The number does not show the full scale of the campaign: the search does not take into account part of the forks, and the owners of infected projects gradually delete malicious files. Therefore, researchers continue to clarify the number of victims.
GhostAction has been working for more than a year and refers to supply chain attacks, where access to the developer helps to get to the code, assembly infrastructure and project credentials. In September 2025, the criminals reached 817 repositories and stole at least 3,325 secrets. The new activity was not limited to the October wave: from August 31 to September 30, 2026, the researchers found 772 repositories, where the attackers added a previous version of the malicious script.
How criminals initially gain control over developer accounts is not yet established. The researchers allow the use of previously stolen access tokens or credentials from databases collected by password thaws, but there is no direct evidence of a specific way of hacking for the current wave.
Owners of affected projects are advised to remove malicious scenarios from all branches, check the history of GitHub Actions launches and withdraw credentials that allowed criminals to log in to the account. One replacement for current secrets is now not enough: if the key has ever been in the history of the repository, it should also be considered compromised and replaced.
