GhostAction attack plants malicious workflows in GitHub repositories
Start here
StepSecurity and Socket disclosed that the GhostAction supply chain attack campaign pushed malicious GitHub Actions workflows to more than 340 repositories through two well-known open source maintainer accounts. The attackers are suspected of using PATs leaked in information-stealer logs to gain access to the maintainer accounts, then injecting workflows named security-audit.yml or github_actions_security.yml that exfiltrated data via curl over plaintext HTTP.
Generated by AI from reports · Updated 3 days ago
Progress timeline
- The Hacker NewsGhostAction 攻击向数万个 GitHub 仓库植入窃取凭证的 Actions workflow
StepSecurity 和 Socket 披露，GhostAction 供应链攻击活动通过两个高知名度开源维护者账号，向 340 多个仓库推送了恶意 GitHub Actions workflow。攻击者疑似利用信息窃取日志中泄露的 PAT 获取维护者账号，随后注入名为 security-audit.yml 或 github_actions_security.yml 的 workflow，通过 curl 以明文 HTTP 将数据外传到硬编码 IP 193.32.204[.]199。窃取内容包括仓库的 GitHub Actions secrets、CI/CD 凭证，以及工作树和完整 git 历史中的 AWS、Anthropic、OpenAI、OpenRouter API key 和 GitHub、GitLab token。
Related discussion
Attention trend
New sources per day
- Oct 10New1 sources (1 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)