GhostAction turns GitHub Actions into a secret trap
GitGuardian saw GhostAction spike on Oct. 8-9, 2026, using about 1,900 compromised GitHub accounts to target more than 30,000 repositories and attempt to extract 3,174 CI secrets. GitHub started blocking the malicious workflow from running on Oct. 9.
The campaign works by taking over legitimate maintainer accounts and pushing a fake workflow that looks like routine security automation. Because it runs through normal GitHub Actions, it can read secrets the repository already trusts during builds, including cloud, package, and API credentials.
For teams that rely on GitHub Actions and stored secrets, the exposure is not limited to the bad workflow file itself: reused or unrotated credentials can keep a previously hit repository useful to attackers months later. GitHub’s block stopped later runs, but it does not erase secrets already copied out or reused elsewhere.