Key points
- Socket identified malicious workflow files in 346 GitHub repositories during a recent sweep.
- The attack expands beyond CI/CD secrets to include cloud provider and AI service credentials.
- Attackers used stolen maintainer accounts to push code that posts data to a remote server.
The short version
- Two GitHub accounts pushed a malicious file to hundreds of repositories on October 8, 2026.
- The payload collects secrets from GitHub Actions storage and scans git history for credentials.
- Socket observed the activity across namespaces owned by henrywoo and kitao, plus one Uber repo.
The details
Socket published research on October 9, 2026, detailing a renewed surge of the GhostAction campaign. The firm observed a single-file commit added to hundreds of GitHub repositories on the previous day. The commit introduced a workflow file named security-audit.yml into the .github/workflows directory. Despite its name, the file performs no security checks. Instead, it gathers credentials and sends them via an HTTP POST request to an external IP address identified as 193.32.204.199.
The malicious code was pushed by two accounts, henrywoo and kitao. Socket found the file in 346 repositories in total. The henrywoo account was responsible for 318 of these, including 39 original source repositories and 279 forks. The kitao account pushed the file to 27 repositories. One notable target was uber/athenadriver, an Uber-owned project where henrywoo had write access as the original author. The henrywoo commits occurred between 21:10:15Z and 21:26:32Z, while kitao repositories carry timestamps in a four-minute window at 13:40–13:44Z.
The campaign targets both active and dormant repositories, suggesting automated enumeration rather than manual selection. As of October 9, 2026, Socket noted that the malicious workflow remained on the default branch of checked repositories. The file had executed successfully in affected projects. However, Socket did not observe any malicious packages published to PyPI or crates.io as a direct result of this specific activity at the time of reporting.
The context
This event represents an evolution of the GhostAction campaign first documented by GitGuardian in September 2025. Earlier waves focused exclusively on stealing secrets stored in GitHub Actions configuration. The new variant retains that capability but adds a regex-based sweep for credentials committed directly into source code or git history. This expansion targets cloud provider keys and AI service tokens that developers may have inadvertently left in their commit logs.
The attack relies on compromised maintainer credentials. Socket did not observe the initial breach method. Once access is gained, the attacker scans the repository for existing Actions secret names. These names are injected into the payload before it is committed, allowing the workflow to extract the specific secrets configured for that repository. The scale of the operation, with 346 repositories processed in short bursts, indicates tool-driven automation rather than manual effort.
What to watch
Defenders should monitor for unexpected workflow files, particularly those with generic names like security-audit or similar variations. Organizations should audit git history for accidental credential commits, as the new payload specifically targets these exposed tokens. Users should also review access permissions for all repository maintainers, as the campaign relies on stolen credentials to push malicious code.
What to do and how to stay safe: GhostAction
- Audit all GitHub repositories for unauthorized workflow files, especially those named security-audit.yml or similar generic titles.
- Rotate all cloud provider and AI service credentials that may have been committed to git history, as the new payload scans for these.
- Review and restrict write access for all maintainer accounts to prevent unauthorized code pushes to default branches.
- Check for any unexpected HTTP POST requests from CI/CD pipelines to external IP addresses not in your allowlist.
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which repositories are affected by this GhostAction wave?
Socket identified 346 affected repositories, including those under the henrywoo and kitao namespaces and the uber/athenadriver repository.
How does this attack differ from previous GhostAction campaigns?
This variant expands beyond stealing GitHub Actions secrets to also scanning git history for cloud and AI credentials committed in code.
Has the attacker published malicious packages as a result?
Socket has not observed any malicious package versions published to PyPI or crates.io as a result of this specific activity yet.
