New GhostAction Wave Hijacks 500+ GitHub Accounts to Steal Cloud and AI API Keys From Git History

What happened

Socket first documented a burst on October 8, 2026 in which two accounts, henrywoo and kitao, pushed a single-file commit adding .github/workflows/security-audit.yml to every repository they could write to. Socket observed the file in 346 repositories: 318 under henrywoo (39 source repositories and 279 forks), 27 under kitao, and uber/athenadriver.

The Uber-owned repository was reached because henrywoo is its original author and still has write access. Uber itself was not breached - the point is that a compromised maintainer's blast radius is every repository in every organization that account can write to.

In an update the same day, Socket said it had identified "more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since October 7, 2026, including several organization-owned ones reached through the compromised contributors." Its chart puts the total at an estimated 30,000+ repositories, scaled from a sample of 1,781 injected repositories - an estimate, not a count.

The sweeps were fast and indiscriminate. henrywoo's repositories were hit between 21:10 and 21:26 UTC, and kitao's within a four-minute window from 13:40 to 13:44 UTC. Repositories that had been dormant for a decade were included, which Socket calls "consistent with automated enumeration rather than selective targeting".

How the accounts were compromised is not known. Socket says it "did not observe how"; the delivery method - stolen maintainer credentials used to commit a plausibly named workflow - is unchanged from earlier waves.

How the fake security workflow works

The commits use innocuous messages such as "Add security audit workflow" and "Update security audit workflow" and land directly on the default branch. The workflow runs on any push to any branch or tag, with no filter, and also accepts workflow_dispatch so the operator can re-run it by hand. In Socket's words, "The workflow has no security function. It collects credentials and POSTs them to" a bare IP address over plain HTTP: hxxp://193.32.204[.]199.

The inherited half: named Actions secrets

As in previous GhostAction waves, the operator first reads the repository's existing workflows for the names of the Actions secrets they use and writes those names into the payload. For kitao/pyxel - an 18,420-star Rust and Python project that ships to PyPI and crates.io - that meant CARGO_REGISTRY_TOKEN, PERSONAL_ACCESS_TOKEN, PYPI_PASSWORD and PYPI_USERNAME: exactly the credentials needed to publish a malicious release of a trusted package. In Socket's sample, only 0.8% of repositories had named secrets in the payload.

The new half: the full git history sweep

The new code checks out the repository with actions/checkout@v4 and fetch-depth: 0, pulling every branch and tag, then runs git log -p --all to read the complete patch history. Both the working tree and the history are grepped for 13 credential patterns, and the two lines either side of every AWS access key ID are captured so the attacker can reconstruct complete key pairs.

• AWS: access key IDs (AKIA...), STS temporary key IDs (ASIA...), secret access keys and session tokens
• AI providers: Anthropic (sk-ant-), OpenAI project keys (sk-proj-) and OpenRouter (sk-or-)
• Code hosts: GitHub classic PATs (ghp_), GitHub fine-grained PATs (github_pat_) and GitLab PATs (glpat-)
• Other services: Google, Firebase and GCP API keys (AIza...), Slack tokens (xox[baprs]-) and SendGrid keys (SG.)

Every run also reports the repository identifier back to the operator whether or not anything was found, giving them a map of execution contexts they can reach. ML projects are an obvious draw: henrywoo/pyllama (2,777 stars) and henrywoo/chatllama (1,200 stars) are the kind of repositories whose users routinely hold AWS and AI API keys.

Where things stand

As of October 9, the workflow file was still on the default branch of the repositories Socket checked, including uber/athenadriver and kitao/pyxel, and "The injected workflow has run successfully in affected repositories." Socket also reports that it has "observed no malicious package versions published to PyPI or crates.io as a result of this activity at the time of writing."

Forks are a lingering risk. Each of the 279 forks in the henrywoo namespace carries the workflow, and if Actions are enabled a later push can trigger the harvest. Downstream forks that inherit the file when created or synced are exposed too, with private forks and mirrors the most at risk.

The third GhostAction wave in just over a year

GitGuardian first reported GhostAction on September 5, 2025: 327 GitHub users, 817 repositories and at least 3,325 secrets exfiltrated, including DockerHub, GitHub, npm and PyPI tokens, AWS keys and database credentials. The campaign returned between August 31 and September 30, 2026, when GitGuardian found the workflow - then named github_actions_security.yml - in 772 public repositories belonging to 373 users and organizations, targeting 2,577 secrets and sending them to the same IP address used in October.

What is new in the October wave is the reach. Earlier versions could only take secrets configured in GitHub Actions; this one turns every key ever committed to a repository, on any branch, into loot.

What developers and maintainers should do

Socket's guidance starts with triage: open the injected file and read line 15. A populated secret list means Actions secrets were exposed; an empty [ -n "" ] check means the exposure is limited to committed credentials. If in doubt, treat both as exposed.

If Actions secrets were named

• Rotate every named secret, and revoke rather than rotate any personal access token.
• Review release history on every registry the secrets could publish to.
• Treat any completed run of the workflow as a successful exfiltration.

If the repository history was swept

• Scan the full history with git log -p --all, including unreachable objects.
• Rotate every credential found in any of the 13 categories, even ones deleted long ago.
• For AWS keys, review CloudTrail and look for new IAM users, new access keys and activity in unexpected regions.

In every case

1. Remove the workflow and revert the commit on every affected repository, including organization-owned ones.
2. Treat the account as fully compromised: revoke sessions, PATs, OAuth grants and SSH keys, then enforce phishing-resistant MFA and re-enroll.
3. Review the organization audit log.
4. Hunt for and block egress to 193.32.204[.]199, including from self-hosted runners.
5. Enable GitHub secret scanning with push protection, and require approval for workflow runs from outside collaborators.
6. If you own a fork, check for .github/workflows/security-audit.yml before enabling Actions.

Sources

• Socket, October 9, 2026: socket.dev/blog/ghostaction-cloud-credentials
• GitGuardian, 2026 return of GhostAction: blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns
• GitGuardian, September 5, 2025 original report: blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen

Key takeaways

• Socket estimates the October 7-8 GhostAction wave reached 30,000+ repositories through more than 500 hijacked GitHub accounts; it directly observed 346 in the first burst.
• The fake security-audit.yml workflow now sweeps every branch and the full git history for 13 credential types, including AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab keys.
• Keys deleted from a repository years ago are exposed if they remain in its history - rotate them.
• No malicious PyPI or crates.io releases had been observed as of October 9, but completed workflow runs should be treated as successful exfiltration.
• Remove the workflow, revoke the account's sessions and tokens, block 193.32.204[.]199 and check forks before enabling Actions.