Stolen credentials: attackers plant a data thief in more than 30,000 GitHub projects
The GhostAction campaign has taken over around 1,900 GitHub accounts and tried to grab thousands of access keys from software projects. GitHub is now blocking the malicious code.
Symbolic image · Photo: Watty62 / Wikimedia Commons, CC BY-SA 4.0 (cropped and resized)
A large-scale wave of attacks on the developer platform GitHub has targeted more than 30,000 software projects belonging to around 3,000 users and organisations. According to security firm GitGuardian, as reported by The Hacker News on Thursday, about 1,900 user accounts were compromised. The attackers tried to extract 3,174 secrets from the automated build pipelines of public projects. The campaign, called GhostAction, first surfaced in September 2025 and has since returned in several waves.
The method: using stolen access tokens or passwords from infostealer logs, the attackers obtain write access. They then add a manipulated GitHub Actions workflow with harmless-sounding names such as 'security-audit.yml'. It scans the project, including its version history, for keys to cloud services such as AWS, GitHub and GitLab tokens, credentials for package registries such as npm, PyPI and DockerHub, and API keys from AI providers. On 8 and 9 October, the code was first pushed to 160 previously hit projects and, about 20 minutes later, to some 28,000 new ones, according to GitGuardian.
Since 9 October, GitHub has been preventing the malicious workflow from running, the researchers said, so later waves on 10 and 12 October captured no data. Notably, some victims had already been hit in earlier waves. This suggests the attackers are relying on credentials that were never rotated after the first incidents. Experts therefore advise project owners to check for suspicious workflow files and to renew affected keys and tokens.