GhostAction is an ongoing GitHub supply-chain campaign in which attackers use stolen developer credentials to add malicious GitHub Actions workflows under legitimate identities. The October 2026 wave searched repository files and Git history for cloud, CI/CD and platform secrets, then sent matches to attacker-controlled infrastructure.
GitHub began blocking the identified workflow after the October 8–9 burst, but injected workflows, exposed credentials and incomplete cleanup leave affected maintainers with an incident-response task—not just a file-removal task.
As an Amazon Associate I earn from qualifying purchases.
How large was the October 2026 GhostAction wave?
GitGuardian’s October 2026 analysis found that the latest burst reached more than 30,000 repositories across 3,000 users and organizations. About 1,900 GitHub accounts were compromised, and the attackers attempted to extract 3,174 secrets from public-repository CI. The figures describe attempted collection; they do not mean every repository ran the workflow or that every secret was successfully stolen.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Period | Observed activity | Secret activity |
|---|---|---|
| September 2025 | 817 public repositories across 327 GitHub users | At least 3,325 secrets exfiltrated |
| August 31–September 30, 2026 | 772 public repositories across 373 users and organizations | 2,577 secrets targeted |
| October 8–9, 2026 | More than 30,000 repositories across 3,000 users and organizations; about 1,900 accounts compromised | 3,174 attempted extractions |
| October 9 onward | GitHub began preventing the malicious workflow from running | GitGuardian reported that later injections on October 10 and October 12 could not extract secrets |
The September 2025 activity shows that GhostAction is a continuing campaign rather than a one-day incident. Some victims in the newer waves had also been targeted previously.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How GhostAction compromised GitHub accounts
Stolen identities supplied repository write access
The attackers used stolen GitHub personal access tokens and other credentials obtained from infostealer logs or credential dumps. With that access, they changed repositories while appearing to be the legitimate account holder. The direct repository-write approach differs from a poisoned dependency: the attacker inserts automation into the victim’s own project instead of waiting for downstream users to install a malicious package.
Routine-looking workflow names hid the payload
Injected files used names such as security-audit.yml and security-check.yml. Commit messages included phrases like Add security check workflow and Update Github Actions Security workflow. That wording was designed to blend into normal maintenance activity and make a malicious change harder to spot in a busy repository.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
The code searched present and past repository data
Early October payloads searched repository files and Git history for credential patterns. Later variants added more context around AWS key IDs and expanded history scanning. A history search matters because a secret deleted from the current branch can remain in older commits, tags or other references.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In the October wave, collected data was sent over HTTP to the bare IP address 193.32.204.199. The payload’s targets included credentials used by cloud platforms, deployment systems, container registries, databases, FTP services, package publishing and other automation.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Injection did not always mean execution
GitGuardian’s execution data from the August–September 2026 wave illustrates the difference between a workflow being committed and a secret being exposed. Researchers observed 3,669 workflow runs across 605 repositories. GitHub held most runs for approval: 499 runs executed in 32 repositories, 336 completed successfully, and 26 secrets were exfiltrated from 13 repositories.
By October 5, only 124 repositories—16% of the observed set—had been effectively cleaned in public history. These numbers are specific to the observed August–September activity and should not be treated as a success rate for every October target. GitHub’s later blocking reduced execution opportunities, but it does not erase a workflow, a stolen token or a secret already copied elsewhere.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Which credentials were attractive to the attackers?
For the August–September wave, GitGuardian recorded these targeted categories:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Credential category | Targeted items |
|---|---|
| SSH private keys and deployment credentials | 446 |
| Azure credentials | 218 |
| Container-registry credentials | 142 |
| Database credentials | 112 |
| AWS access keys | 106 |
| FTP credentials | 92 |
| Google Cloud/Firebase credentials | 80 |
| GitHub tokens | 66 |
A credential found only in Git history still requires action. If it was valid during the period when an attacker could read the repository or run its workflow, assume it may have been copied and rotate it.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
What to check after a suspicious workflow appears
- Preserve evidence first. Record the commit, workflow file, workflow-run details, timestamps, actor, runner output and relevant audit-log entries. Do not destroy the only evidence while trying to clean the repository.
- Review GitHub audit logs. Look for unexpected workflow additions, repository writes, token use, permission changes and unfamiliar account activity. Check the account that authored the commit as well as repository collaborators and automation identities.
- Search code and history. Search current branches and Git history for
security-audit.yml,security-check.yml, the endpoint193.32.204.199, suspicious workflow text and credential-pattern matches. Include deleted files, tags and old commits where your tooling permits. - Remove the malicious workflow. Delete the file and revert unauthorized changes only after collecting the evidence needed for investigation. Check forks, branches and other repositories that the same account could write to.
- Revoke the enabling GitHub credential. Revoke the personal access token, OAuth token, SSH credential or other account credential that allowed the repository change. Removing downstream secrets without revoking this credential leaves the entry point available.
- Rotate every exposed secret. Replace cloud, registry, database, CI/CD, package-publishing, chat-bot and deployment credentials found in files, logs or Git history. Review access logs and reduce permissions for replacement credentials.
- Strengthen prevention. Enable or review secret scanning and push protection, require approval for workflows from new or untrusted sources, and consider phishing-resistant FIDO2/WebAuthn authentication for developer accounts. GitHub announced context-aware AI assistance for secret-scanning alerts and push protection on October 7, 2026; some capabilities were in preview at that time.
What GhostAction means for affected maintainers
A compromised developer account can be reused by more than one actor. GitGuardian found that some GhostAction victims later appeared in separate cryptomining campaigns, so every later action should not automatically be attributed to GhostAction. The practical response is the same: establish which identity made each change, revoke that identity’s access, and investigate all credentials and systems reachable from the repository.
The campaign’s history scanning also changes the cleanup boundary. Deleting a workflow and removing a secret from the latest branch is not sufficient when older commits contain the same value. Treat historical exposure as real exposure until the credential owner confirms revocation and replacement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
