GitGuardian reported on 7 October 2026 that GhostAction, the CI/CD supply-chain campaign it first exposed in September 2025, ran a new wave from 31 August 2026. Using what appear to be stolen GitHub credentials, the attacker committed a workflow named 'Github Actions Security' to 772 public repositories belonging to 373 GitHub users and organisations by 30 September; each workflow lists the repository's own secret names (scraped from earlier workflow history) and posts their values over plain HTTP to a bare IP address.

Together the injected workflows target 2,577 secrets, most often SSH keys and Azure, AWS and database credentials. A variant named 'Security Check' (security-check.yml) appeared in seven repositories from 7 September and tags each theft with an injection ID. GitHub held most runs for approval: of 3,669 runs GitGuardian collected across 605 repositories, 499 executed in 32 repositories and 336 completed, exfiltrating 26 secrets from 13 repositories, with new runs still triggering.

Only 124 repositories (16%) had been cleaned in public history by 5 October. In 92 cases the attacker simply re-pointed workflows left over from earlier waves, so GitGuardian says the campaign never really stopped. It also found 13 victim repositories used for GitHub Actions cryptomining by at least four other campaigns, including an XMRig miner hidden in the Docker image of the popular kuafuai/DevOpsGPT project, and thinks the stolen GitHub credentials are being traded among several actors.

Researchers at Cynative independently spotted the commits. Primary: GitGuardian; wire: SecurityWeek.

UPDATE (9 Oct): StepSecurity and Socket documented a new burst on 8 October in which two compromised maintainer accounts committed a workflow named 'security-audit.yml' ('Add security audit workflow') to every repository they could write to: 27 under kitao (Takashi Kitao, author of the 18,400-star pyxel game engine, published to PyPI and crates.io) from 13:20 UTC, then 318 under henrywoo (39 source repositories and 279 forks) plus Uber's uber/athenadriver in a 16-minute window from 21:10 UTC. This version sends named Actions secrets and also scans the working tree and full git history for cloud, AI and SaaS keys (AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab tokens), posting them in cleartext to 193.32.204[.]199; StepSecurity confirmed from the athenadriver run log that exfiltration completed four seconds after the run started.

Socket's 9 October update says more than 500 GitHub accounts have committed the workflow to tens of thousands of repositories since 7 October, including organisation-owned ones reached through compromised contributors.

No malicious PyPI or crates.io releases had been published as of 9 October, but the stolen publishing tokens stay usable until rotated.

UPDATE 13 October (GitGuardian; wire: The Hacker News, 15 Oct): GitGuardian says the campaign accelerated sharply between 8 and 12 October, peaking on 8–9 October. Its dataset now shows the actor targeted more than 30,000 repositories across 3,000 users and organisations by compromising the GitHub accounts of about 1,900 users, attempting to extract 3,174 secrets from public repositories' CI. The payload went first to 160 previously seen victims and, 20 minutes later, to about 28,000 new repositories on 8–9 October; later versions also capture the lines around each AWS key ID found in git history so the actor can pair it with its secret access key.

Further waves on 10 and 12 October used the same payload but could not extract any secrets, because GitHub began preventing the malicious workflow from running on 9 October. Some victims of this burst had already been hit in the September 2025 and August 2026 waves, which GitGuardian reads as the actor relying on secrets that were never rotated.

UPDATE 19 October 2026 (OpenSourceMalware, 9, 11 and 16 Oct; wire: The Hacker News, 19 Oct): the operator has moved beyond workflow injection. On 9 October it registered my-github[.]com, which resolves (with wildcard DNS) to the same collector, 193.32.204[.]199, and that day emailed an open-source maintainer a fake GitHub 'new sign-in from Moscow' security alert from noreply@my-github[.]com. The link opened a reverse-proxy phishing page that captured the password and authenticator code and ran injected JavaScript that silently approved a GitHub OAuth device flow with repo, workflow and read:org scopes, sending the resulting token to my-github[.]com on TCP 8443, so the victim never sees or types a device code.

A lookalike my-gitlab[.]com (registered 22 September) uses the same naming but is not technically linked to the operator. Separately, OpenSourceMalware, starting from a find by Jamf's Thijs Xhaflaire, documented a second stage in 94 repositories belonging to 66 owners, most of them dormant for over a year: after a Stage 1 workflow on 8 October, the main burst on 15 October (UTC) committed a .vscode/tasks.json set to run on folder open, a fake font public/fonts/fa-solid-400.woff2 (the file name used by North Korea's PolinRider campaign) that is really a JavaScript stealer, and a second workflow under names such as lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml or test-suite.yml with more credential patterns and a secret-gist fallback.

Opening the project in VS Code runs the stealer, which takes AWS, PyPI, npm, Git, Kubernetes, SSH and Claude, Gemini, OpenAI and Hugging Face credentials, posts them over plain HTTP to port 8080 on the same server and installs a cron job (marked #ghc2) that fetches and runs server-supplied code every five minutes; deleting the font file does not remove the cron job. One repository also got a cache-cleanup.yml workflow aimed at self-hosted runners that reads cloud IAM role credentials and SSH keys.

This stage does not need GitHub Actions to run, so GitHub's 9 October block does not stop it. OpenSourceMalware found no shared indicators with North Korean malware and calls it a copycat of PolinRider's technique.