---
title: "GhostAction: Fake Security Workflows Steal GitHub Secrets"
url: https://erroneo.us/security/briefs/ghostaction-github-workflow-credential-theft/
description: "Stolen GitHub logins planted fake 'security audit' workflows in 30,000+ repos (Aug-Oct 2026) that mine secrets and git history. Check workflows, rotate."
type: security-brief
section: "Security Digest"
date_published: 2026-10-07
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# GhostAction: Fake Security Workflows Steal GitHub Secrets

**Verdict: Check exposure.** If any repository you own or contribute to gained a security-audit.yml or github_actions_security.yml workflow you did not write, treat its Actions secrets, every credential ever committed to it, and the pushing account as compromised.

- **Who must act:** Maintainers and organizations whose repositories, including forks and mirrors, received an injected 'Security Audit' or 'Github Actions Security' workflow since August 31, 2026, and anyone whose GitHub token or password may sit in infostealer logs.
- **Who can relax:** Repositories with no such workflow in any branch, and organizations that already require approval for workflow runs and block direct pushes to .github/workflows; GitHub has been stopping the October payload from running since October 9.
- **Affected:** Public repositories that received the injected workflow Aug 31-Sep 30, 2026 (772 repos, 373 users/orgs per GitGuardian); More than 30,000 repositories across about 3,000 users and orgs in the Oct 8-12, 2026 surge (about 1,900 compromised user accounts, per GitGuardian); Forks and private mirrors of infected repositories that inherit the workflow
- **Fixed:** No software fix; GitHub began preventing the malicious workflow from running on Oct 9, 2026 (per GitGuardian); Remediation: remove the workflow, revoke the pushing credential, rotate exposed secrets
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Search every branch of your repositories and forks for security-audit.yml, github_actions_security.yml and security-check.yml, and for the string 193.32.204.199.
2. If found, revoke the GitHub credential that pushed it (PATs, OAuth grants, SSH keys, sessions) and re-enroll the account with phishing-resistant MFA.
3. Rotate every Actions secret named in the workflow and every credential ever committed to the repository, including ones deleted from history.
4. Delete the workflow from all branches, revert the commit, and check forks before enabling Actions on them.
5. Require approval for workflow runs, protect .github/workflows with rulesets or CODEOWNERS, and turn on secret scanning push protection.

### How to check if you are affected

- Code search your org: "AKIA_CTX_START", "c=monami" and "193.32.204.199" path:.github/workflows.
- Audit logs: maintainer accounts adding workflow files directly to default branches, unsigned bursts of commits titled 'Add security audit workflow' or 'Add Github Actions Security workflow', and workflow_dispatch on new 'audit' workflows.
- Actions run history: completed runs of a 'Security Audit' or 'Github Actions Security' workflow since August 31, 2026 mean the named secrets were sent.
- Egress logs and CloudTrail: traffic to 193.32.204.199 (ports 80 and 3000), then new IAM users, access keys or unusual regions for any AWS key found in the repo.

## What happened

GhostAction uses stolen maintainer credentials to commit a workflow that looks like a security check but exists to send secrets to the attacker. GitGuardian first documented it in September 2025. In its [October 7, 2026 report](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/), GitGuardian says "GhostAction never really stopped." Between August 31 and September 30, 2026, a `github_actions_security.yml` workflow was pushed to 772 public repositories belonging to 373 users and organizations, naming 2,577 secrets. Most of those runs were held for approval. Of 3,669 runs GitGuardian collected, 336 completed and exfiltrated 26 secrets from 13 repositories.

The October wave was far larger and more capable. [Socket](https://socket.dev/blog/ghostaction-cloud-credentials) and [StepSecurity](https://www.stepsecurity.io/blog/ghostaction-returns) traced an October 8 burst through two compromised maintainer accounts. `kitao`, the author of Pyxel, pushed to 27 repositories. `henrywoo` pushed to 318 repositories, including 279 forks, in 16 minutes, ending with Uber's `uber/athenadriver`. Commits used the victims' real identities, went straight to the default branch and were unsigned. By its October 13 update, GitGuardian counted more than 30,000 repositories across about 3,000 users and organizations, about 1,900 compromised user accounts and 3,174 targeted secrets. It reports that GitHub began preventing the workflow from running on October 9, so waves on October 10 and 12 extracted nothing. GitHub has not published a statement as of October 21, 2026.

## Who is affected

The new `security-audit.yml` runs on any push or manual dispatch and checks out full history with `fetch-depth: 0`. It sends the repository's named Actions secrets, then greps the working tree and `git log -p --all` for 13 credential patterns. Those cover AWS keys and session tokens, Anthropic, OpenAI and OpenRouter keys, GitHub and GitLab PATs, and Google, Slack and SendGrid keys. Everything goes in one plain-HTTP POST to `193.32.204.199`. Scanning history means credentials committed years ago and later deleted were exposed. GitGuardian reads that as aimed at private repositories, where committed secrets are common. Forks carry the file too, and enabling Actions on a fork or syncing it can run the harvester.

## Do you really need to act?

Check, yes. Panic, no. The question is whether the workflow landed in anything you own, fork or mirror, and whether it ran. StepSecurity found that a run on `uber/athenadriver` reached the attacker's server four seconds after starting, while runs held at `action_required` by an approval gate never executed. Researchers had seen no malicious package releases using the stolen PyPI, crates.io or other publishing credentials as of October 9. That is not proof the tokens are safe. GitGuardian also stresses that some victims appeared in earlier waves, which suggests secrets were never rotated, and that a compromised account "must be found and revoked too, or someone else will use it again."

## What to do now

1. Find the workflow: `gh search code '193.32.204.199' --owner <org>` and `gh search code 'AKIA_CTX_START' --owner <org>`. Locally, run `git log --all --name-only -- .github/workflows/ | grep -E 'security-audit|github_actions_security|security-check'`.
2. Revoke the account's credentials: PATs, OAuth apps, SSH keys and active sessions. Then reset the password with phishing-resistant MFA, assuming an infostealer.
3. Rotate every secret the workflow named and every credential found by `git log -p --all`. Review registry release history and CloudTrail.
4. Delete the workflow from all branches and revert the commit. Audit forks before enabling Actions.
5. Require [approval for workflow runs](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/approve-runs-from-forks), protect `.github/workflows/`, restrict `GITHUB_TOKEN` permissions per [GitHub's secure-use guidance](https://docs.github.com/en/actions/reference/security/secure-use), and enable push protection.

## How to tell if you were hit

A completed run of a "Security Audit" or "Github Actions Security" workflow since August 31 means the named secrets were sent. The marker `?c=monami` means named secrets were found, and `?c=new` means history-only results. In the [organization audit log](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization), look for maintainers adding workflow files directly to default branches. Also look for rapid unsigned commits titled "Add security audit workflow" and for `workflow_dispatch` on new audit workflows. Search egress telemetry for `193.32.204.199` on ports 80 and 3000, and CloudTrail for new IAM users or keys tied to any AWS key in the repository.

## Timeline

- Aug 31, 2026 — First 2026 burst: 143 repositories receive `github_actions_security.yml`.
- Sep 5, 2026 — Peak day of the late-summer wave, with 294 repositories (per GitGuardian).
- Oct 7, 2026 — GitGuardian publishes its report, and the October wave begins (per Socket).
- Oct 8, 2026 — The `kitao` and `henrywoo` accounts push the history-mining variant, and a phased push reaches about 28,000 new repositories by Oct 9.
- Oct 9, 2026 — GitHub starts preventing the workflow from running. Socket and StepSecurity publish, and [press coverage](https://thehackernews.com/2026/10/credential-stealing-github-actions.html) begins.
- Oct 15, 2026 — [Reporting](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html) on GitGuardian's updated count of about 1,900 compromised accounts.

## Sources

1. [GitGuardian — GhostAction returns (Oct 7, 2026, updated Oct 9 and 13)](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/)
2. [Socket — GhostAction wave targets cloud credentials](https://socket.dev/blog/ghostaction-cloud-credentials)
3. [StepSecurity — GhostAction returns](https://www.stepsecurity.io/blog/ghostaction-returns)
4. [GitHub Docs — Approving workflow runs from forks](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/approve-runs-from-forks)
5. [GitHub Docs — Reviewing the audit log for your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization)
6. [GitHub Docs — Secure use reference for GitHub Actions](https://docs.github.com/en/actions/reference/security/secure-use)
7. [The Hacker News — Credential-stealing GitHub Actions workflows planted by GhostAction (Oct 9, 2026)](https://thehackernews.com/2026/10/credential-stealing-github-actions.html)
8. [The Hacker News — GhostAction compromises about 1,900 GitHub accounts](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html)

---
Source page: https://erroneo.us/security/briefs/ghostaction-github-workflow-credential-theft/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt