The credential-theft campaign known as **GhostAction** has dramatically escalated, impacting more than 30,000 repositories belonging to 3,000 users and organizations. According to **GitGuardian**, this spike was observed on October 8 and 9, 2026. Security researchers Gaetan Ferry and Guillaume Valadon noted, "This resulted from compromising the **GitHub** accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI." ### Understanding GhostAction's Modus Operandi **GhostAction** is a supply chain attack that targets developer infrastructure on **GitHub**. First identified in September 2025, the campaign involves threat actors gaining unauthorized access to legitimate developer accounts. They then inject malicious **GitHub Actions** automation workflows into software repositories. Attackers typically achieve write access to repositories by using stolen **Personal Access Tokens (PATs)** or credentials obtained from infostealer logs and dumps. Once an account is hijacked, a malicious workflow file is pushed, often disguised under innocuous names like "security-audit.yml" or "github_actions_security.yml." ### The Goal: Widespread Secret Theft The primary objective of this activity is the large-scale theft of continuous integration and continuous deployment (**CI/CD**) secrets, cloud credentials, package registry tokens (such as **npm**, **PyPI**, and **DockerHub**), and **Artificial Intelligence (AI)** provider API keys. ### A New, Evolving Wave of Attacks A new wave of **GhostAction** activity has been observed since August 31, 2026, with the malicious workflow deployed to hundreds of repositories. **GitGuardian** states this new wave appears "more experimental and manual than previous ones, with the payload evolving over time." Compared to the original **GhostAction** payload, the initial version of this new payload introduced a `git history secret-scanning` feature. This functionality, previously highlighted by **Socket** and **StepSecurity**, uses secret-detection regular expressions to identify **AWS** key IDs, **GitHub** and **GitLab** tokens, **AI**-related secrets, and various cloud API keys. ### Payload Evolution and Mitigation Efforts A second iteration of the payload was designed to capture approximately two lines of context around every **AWS** key ID hit, enabling pairing with corresponding secret access keys. A third and final variant further refined this to include support for retrieving the secret context during the `git history` scan. "This payload was deployed in multiple phases," **GitGuardian** explained. "First to 160 previously observed victims, then, 20 minutes later, to 28,000 new repositories between October 8 and 9. New waves have been observed, using the same payload, on October 10 and 12. However, **GitHub** started preventing the malicious workflow from running starting October 9. Those two subsequent waves therefore could not extract any secrets." Notably, a subset of the victims in this latest surge had also been compromised in the September 2025 and August 2026 waves. This pattern suggests that threat actors are banking on unrotated secrets to facilitate repeat attacks.