ghtier
← Back to Organization plane incidents
OrganizationSeptember 2025, returned 2026

GhostAction

327 compromised GitHub user accounts were used to inject workflows disguised as "Add GitHub Actions Security workflow" across 817 repositories, stealing 3,325 secrets. The actors enumerated secret names from legitimate workflow files first, then hardcoded those names into their own workflow, harvesting PyPI, npm, DockerHub, GitHub, Cloudflare, and AWS credentials. It came back in 2026. GitGuardian found the malicious workflow in 772 public repositories belonging to 373 users and organizations between 31 August and 30 September 2026, aimed at 2,577 secrets; GitHub held most of the runs for approval, and by 5 October only 16% of the repositories had removed the workflow. From 7 October Socket saw more than 500 accounts committing it to tens of thousands of repositories.

Permissions abused

Injected Actions workflowHarvested repo/CI secrets by name

On the permission reference

T1Workflows: Write

Sources

How it unfolded

  1. 1

    327 GitHub accounts are compromised

    The campaign started from 327 already-compromised GitHub accounts, most likely via credential stuffing or reused leaked passwords rather than any GitHub platform vulnerability.

  2. 2

    Existing workflows are read to learn real secret names

    Before writing anything malicious, the actors read each target repository's own workflow files to learn exactly which secret names it referenced — PyPI, npm, DockerHub, GitHub, Cloudflare, AWS — instead of guessing.

  3. 3

    A convincingly-named workflow is injected

    Using the compromised accounts' write access, they committed a new workflow disguised as "Add GitHub Actions Security workflow" — a name designed to look like a routine hardening change — into 817 repositories.

  4. 4

    Secrets are harvested by their real names

    Because the injected workflow referenced the exact secret names it had just enumerated, every one of them resolved and was exfiltrated: 3,325 secrets in total, across six credential types.

Mitigations

  • Enforce MFA on every account, including bots/service accounts — compromised accounts, not a code vulnerability, were the entry point

  • Require CODEOWNERS review on any change under .github/workflows/ — a new workflow file can't land unreviewed

  • Enable secret scanning and push protection — flags exfiltration attempts in an injected workflow

  • Inventory every Actions secret and its scope on a recurring basis — the campaign relied on being able to correctly guess names from existing workflows

  • Scope secrets to the narrowest repo/environment that actually needs them — instead of one org-wide secret reused everywhere

Frameworks

CICD-SEC-1CICD-SEC-6CICD-SEC-10NIST 5.1.2NIST 5.1.4

Part of

Ongoing. First seen September 2025, last seen 9 October 2026. 772 repositories of 373 users and organizations in September 2026, then more than 500 accounts committing it from 7 October (as of 9 October 2026, source). Mapping by ghtier, not yet reviewed. Threat landscape