Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

A credential-theft campaign dubbed GhostAction has compromised developer accounts of high-profile open-source maintainers to inject malicious GitHub Actions workflows into hundreds of repositories. The injected workflows, named 'security-audit.yml' or 'github_actions_security.yml', exfiltrate secrets such as API keys, cloud credentials, and tokens to a hard-coded IP address over HTTP. The attack chain begins with stolen personal access tokens, followed by reconnaissance and deployment of the malicious workflow under the victim's identity, enabling harvesting of credentials from both the working tree and git history.

AI-extracted · verify before operational use