Credential-stealing GitHub Actions workflows planted across tens of thousands of repositories via compromised maintainer accounts

Socket, StepSecurity, and GitGuardian reported a resurgence of the GhostAction supply chain campaign, in which more than 500 GitHub accounts committed a credential-stealing workflow to tens of thousands of repositories since October 7. The attacker likely used maintainer personal access tokens leaked in infostealer logs, starting with the author of the pyxel game engine and spreading to other accounts. The injected workflow, disguised as a security audit, scans the working tree and full git history against 13 secret patterns, including AWS, Anthropic, OpenAI, and GitLab keys, and exfiltrates them over plain HTTP to a hardcoded address. Earlier GhostAction activity hit 772 repositories and thousands of secrets.

Check

Search repositories and forks for security-audit.yml or github_actions_security.yml workflows added since August 31, and if present assume compromise and rotate every exposed secret.

Affected

Repositories whose maintainer tokens were leaked had a rogue workflow injected that steals GitHub Actions secrets and any credentials in the working tree and git history.

Fix

Revoke compromised GitHub credentials, delete the malicious workflow from all branches and forks, rotate all exposed secrets, and store tokens outside infostealer-reachable locations.