The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.
The spike, according to GitGuardian, was observed on October 8 and 9, 2026.
"This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan Ferry and Guillaume Valadon said.
GhostAction is the moniker for a supply chain attack campaign targeting developer infrastructure on GitHub. Originally discovered in September 2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories.
Attackers have been found to gain write access to repositories using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps. Using the hijacked maintainer account, they push a malicious workflow file disguised under deceptive names such as Security Audit ("security-audit.yml") or GitHub Actions Security ("github_actions_security.yml").
The end goal of the activity is the large-scale theft of continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens (like npm, PyPI, and DockerHub), and artificial intelligence (AI) provider API keys.
A new wave of GhostAction has been observed since August 31, 2026, with the malicious workflow pushed to hundreds of repositories.
"This new wave seems more experimental and manual than previous ones, with the payload evolving over time," GitGuardian said. "Compared with the original GhostAction payload, the first version of this new payload added a git history secret-scanning feature."
As previously outlined by Socket and StepSecurity, the history-scanning feature features secret-detection regular expressions covering AWS key IDs, GitHub and GitLab tokens, AI-related secrets, and cloud API keys.
A second version of the payload also captures about two lines of context around every AWS key ID hit so as to pair them with their matching secret access keys. A third and final variant of the payload includes support for retrieving the secret context during the git history scan.
"This payload was deployed in multiple phases," GitGuardian said. "First to 160 previously observed victims, then, 20 minutes later, to 28,000 new repositories between October 8 and 9. New waves have been observed, using the same payload, on October 10 and 12. However, GitHub started preventing the malicious workflow from running starting October 9. Those two subsequent waves therefore could not extract any secrets."
Interestingly, a subset of the victims from this new burst were previously compromised in the September 2025 and August 2026 waves, indicating the threat actors are banking on unrotated secrets to pull them off.