GhostAction attack plants credential-stealing Actions workflows in tens of thousands of GitHub repositories
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
StepSecurity and Socket disclosed that the GhostAction supply chain attack campaign pushed malicious GitHub Actions workflows to more than 340 repositories through two high-profile open source maintainer accounts. The attackers are suspected of obtaining the maintainer accounts using PATs leaked in information-stealing logs, then injecting workflows named security-audit.yml or github_actions_security.yml that exfiltrate data via curl over plaintext HTTP to the hardcoded IP 193.32.204[.]199. The stolen content includes the repositories' GitHub Actions secrets, CI/CD credentials, and AWS, Anthropic, OpenAI, OpenRouter API keys and GitHub and GitLab tokens in the working tree and full git history.