GhostAction: Fake Security Workflows Steal GitHub Secrets

What to do

1. Search every branch of your repositories and forks for security-audit.yml, github_actions_security.yml and security-check.yml, and for the string 193.32.204.199.
2. If found, revoke the GitHub credential that pushed it (PATs, OAuth grants, SSH keys, sessions) and re-enroll the account with phishing-resistant MFA.
3. Rotate every Actions secret named in the workflow and every credential ever committed to the repository, including ones deleted from history.
4. Delete the workflow from all branches, revert the commit, and check forks before enabling Actions on them.
5. Require approval for workflow runs, protect .github/workflows with rulesets or CODEOWNERS, and turn on secret scanning push protection.

How to check if you are affected or compromised

• Code search your org: "AKIA_CTX_START", "c=monami" and "193.32.204.199" path:.github/workflows.
• Audit logs: maintainer accounts adding workflow files directly to default branches, unsigned bursts of commits titled 'Add security audit workflow' or 'Add Github Actions Security workflow', and workflow_dispatch on new 'audit' workflows.
• Actions run history: completed runs of a 'Security Audit' or 'Github Actions Security' workflow since August 31, 2026 mean the named secrets were sent.
• Egress logs and CloudTrail: traffic to 193.32.204.199 (ports 80 and 3000), then new IAM users, access keys or unusual regions for any AWS key found in the repo.

What happened#

GhostAction uses stolen maintainer credentials to commit a workflow that looks like a security check but exists to send secrets to the attacker. GitGuardian first documented it in September 2025. In its October 7, 2026 report, GitGuardian says "GhostAction never really stopped." Between August 31 and September 30, 2026, a github_actions_security.yml workflow was pushed to 772 public repositories belonging to 373 users and organizations, naming 2,577 secrets. Most of those runs were held for approval. Of 3,669 runs GitGuardian collected, 336 completed and exfiltrated 26 secrets from 13 repositories.

The October wave was far larger and more capable. Socket and StepSecurity traced an October 8 burst through two compromised maintainer accounts. kitao, the author of Pyxel, pushed to 27 repositories. henrywoo pushed to 318 repositories, including 279 forks, in 16 minutes, ending with Uber's uber/athenadriver. Commits used the victims' real identities, went straight to the default branch and were unsigned. By its October 13 update, GitGuardian counted more than 30,000 repositories across about 3,000 users and organizations, about 1,900 compromised user accounts and 3,174 targeted secrets. It reports that GitHub began preventing the workflow from running on October 9, so waves on October 10 and 12 extracted nothing. GitHub has not published a statement as of October 21, 2026.

Who is affected#

The new security-audit.yml runs on any push or manual dispatch and checks out full history with fetch-depth: 0. It sends the repository's named Actions secrets, then greps the working tree and git log -p --all for 13 credential patterns. Those cover AWS keys and session tokens, Anthropic, OpenAI and OpenRouter keys, GitHub and GitLab PATs, and Google, Slack and SendGrid keys. Everything goes in one plain-HTTP POST to 193.32.204.199. Scanning history means credentials committed years ago and later deleted were exposed. GitGuardian reads that as aimed at private repositories, where committed secrets are common. Forks carry the file too, and enabling Actions on a fork or syncing it can run the harvester.

Do you really need to act?#

Check, yes. Panic, no. The question is whether the workflow landed in anything you own, fork or mirror, and whether it ran. StepSecurity found that a run on uber/athenadriver reached the attacker's server four seconds after starting, while runs held at action_required by an approval gate never executed. Researchers had seen no malicious package releases using the stolen PyPI, crates.io or other publishing credentials as of October 9. That is not proof the tokens are safe. GitGuardian also stresses that some victims appeared in earlier waves, which suggests secrets were never rotated, and that a compromised account "must be found and revoked too, or someone else will use it again."

What to do now#

1. Find the workflow: gh search code '193.32.204.199' --owner <org> and gh search code 'AKIA_CTX_START' --owner <org>. Locally, run git log --all --name-only -- .github/workflows/ | grep -E 'security-audit|github_actions_security|security-check'.
2. Revoke the account's credentials: PATs, OAuth apps, SSH keys and active sessions. Then reset the password with phishing-resistant MFA, assuming an infostealer.
3. Rotate every secret the workflow named and every credential found by git log -p --all. Review registry release history and CloudTrail.
4. Delete the workflow from all branches and revert the commit. Audit forks before enabling Actions.
5. Require approval for workflow runs, protect .github/workflows/, restrict GITHUB_TOKEN permissions per GitHub's secure-use guidance, and enable push protection.

How to tell if you were hit#

A completed run of a "Security Audit" or "Github Actions Security" workflow since August 31 means the named secrets were sent. The marker ?c=monami means named secrets were found, and ?c=new means history-only results. In the organization audit log, look for maintainers adding workflow files directly to default branches. Also look for rapid unsigned commits titled "Add security audit workflow" and for workflow_dispatch on new audit workflows. Search egress telemetry for 193.32.204.199 on ports 80 and 3000, and CloudTrail for new IAM users or keys tied to any AWS key in the repository.

Timeline#

• Aug 31, 2026 — First 2026 burst: 143 repositories receive github_actions_security.yml.
• Sep 5, 2026 — Peak day of the late-summer wave, with 294 repositories (per GitGuardian).
• Oct 7, 2026 — GitGuardian publishes its report, and the October wave begins (per Socket).
• Oct 8, 2026 — The kitao and henrywoo accounts push the history-mining variant, and a phased push reaches about 28,000 new repositories by Oct 9.
• Oct 9, 2026 — GitHub starts preventing the workflow from running. Socket and StepSecurity publish, and press coverage begins.
• Oct 15, 2026 — Reporting on GitGuardian's updated count of about 1,900 compromised accounts.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. GitGuardian — GhostAction returns (Oct 7, 2026, updated Oct 9 and 13) blog.gitguardian.com
2. Socket — GhostAction wave targets cloud credentials socket.dev
3. StepSecurity — GhostAction returns stepsecurity.io
4. GitHub Docs — Approving workflow runs from forks docs.github.com
5. GitHub Docs — Reviewing the audit log for your organization docs.github.com
6. GitHub Docs — Secure use reference for GitHub Actions docs.github.com

Coverage and analysis

1. The Hacker News — Credential-stealing GitHub Actions workflows planted by GhostAction (Oct 9, 2026) thehackernews.com
2. The Hacker News — GhostAction compromises about 1,900 GitHub accounts thehackernews.com