GhostAction is back: fake "security audit" workflows stealing cloud and AI keys

A lot happened this week: NetScaler and FortiMail zero-days, a KillSec ransomware takedown, a GitLab AI Gateway bug rated 9.9. The one I’d tell a developer friend about first is the GhostAction comeback, because it hits something I do every day: push to GitHub and trust that the workflows in my repo are mine.

According to Socket’s write-up on 9 October, more than 500 GitHub accounts have committed a malicious workflow to tens of thousands of repositories since 7 October. It is an evolution of the GhostAction campaign first documented in September 2025.

How it works

The attacker pushes a workflow that looks boring on purpose:

• File: .github/workflows/security-audit.yml (a variant is github_actions_security.yml)
• Commit message: “Add security audit workflow” or “Update security audit workflow”
• It runs on every push, and can also be triggered by hand.
• It collects secrets and sends them in cleartext over HTTP to a hard-coded IP, 193.32.204[.]199.

This wave also goes beyond Actions secrets. It looks for credentials sitting in source code and git history: AWS keys, Anthropic, OpenAI and OpenRouter keys, GitHub and GitLab tokens, Google/Firebase keys, Slack and SendGrid tokens, and PyPI and crates.io publishing credentials.

Two cases show the scale. Socket says the account of the author of kitao/pyxel (about 18,400 stars) was used to push the workflow to 27 repositories. Eight hours later, the account of the original author of Uber’s athenadriver was used to push it to 318 repositories in a 16-minute window.

The part that bothers me

The workflow isn’t exploiting a GitHub bug. The attackers appear to hold valid maintainer credentials, so the commits look legitimate. Socket says it did not observe how the credentials were first obtained. Reporting suggests leaked personal access tokens from infostealer logs or credential dumps, but that is an inference, not something Socket confirmed.

The same week, a scan of 224 million repositories reportedly found hundreds of thousands of still-valid exposed credentials, with a median exposure of 784 days. That is the pool this kind of campaign draws from.

What I’d check in my own repos

1. Search for the files: look for security-audit.yml or github_actions_security.yml under .github/workflows/, and for those commit messages in history.
2. Check Actions run logs for runs you didn’t expect, especially on forks.
3. Rotate anything exposed: Actions secrets, plus keys committed anywhere in history (git log -p --all is a blunt but effective check).
4. Review package releases on PyPI, crates.io and npm for versions you didn’t publish.
5. Block the IP in egress logs, and turn on secret scanning with push protection.
6. Replace long-lived PATs with fine-grained, short-lived tokens or OIDC where possible.

If your tokens leak, your workflow files are the next thing an attacker can edit, and they run with your secrets.

What I verified: the 9 October date, the 500+ account count, the file names, commit messages, exfiltration IP and the pyxel/athenadriver cases match between Socket’s post and GBHackers’ summary. I could not load The Hacker News article (blocked by a bot check), so I relied on search snippets for it. I did not independently verify the attribution to the 2025 GhostAction campaign, the exact number of repositories (“tens of thousands” is Socket’s estimate), or the credential-theft vector. The 224-million-repository scan figure came from a weekly roundup that I did not trace to its original source.