Fake "security audit" workflows are siphoning secrets from tens of thousands of GitHub repos

A fresh wave of the GhostAction campaign is planting credential-stealing GitHub Actions workflows across public repositories. Socket, StepSecurity and GitGuardian report that after two maintainer accounts were taken over — one pushing the workflow to 318 repositories in about 16 minutes — more than 500 accounts have committed the malicious file to tens of thousands of repos since 7 October. The file is disguised as a security audit (security-audit.yml or github_actions_security.yml), runs on workflow_dispatch and unfiltered pushes, scans the working tree and full git history for 13 credential patterns, and posts matches — AWS keys, AI provider keys, GitHub and GitLab tokens — to a hard-coded IP over plain HTTP. No malicious package releases have been seen yet, so theft of secrets appears to be the goal, and forks can inherit the workflow through sync. What to do: search your repos, forks and mirrors for those workflow names (activity goes back to 31 August), assume compromise if found, revoke the underlying token, delete the file from every branch, and rotate every secret the repo could reach. Restricting default token permissions and requiring review for workflow changes are cheap hardening steps.

This is a summary by our content curator. Read the original at The Hacker News: https://thehackernews.com/2026/10/credential-stealing-github-actions.html.