Hackers Steal Cloud Credentials, AI API Keys from 790 GitHub Repos

Key Takeaways

• The “GhostAction” campaign has compromised 790 GitHub repositories by injecting malicious GitHub Actions workflows.
• Attackers are actively siphoning cloud credentials, software-publishing tokens, and AI service API keys.
• The compromise stems from abusing trusted developer accounts, allowing attackers to introduce workflows that exfiltrate sensitive data, including from Git history.
• Removing the malicious workflow is insufficient; affected organizations must revoke all potentially exposed credentials and audit for further compromise.

GhostAction Campaign Hijacks 790 GitHub Repositories

A sophisticated cyber campaign dubbed “GhostAction” has infiltrated 790 GitHub repositories, embedding malicious GitHub Actions workflows designed to steal critical credentials. This extensive compromise puts a wide array of sensitive data at risk, including cloud access keys, software-publishing tokens, and API keys for various artificial intelligence services.

As of October 9, 2026, researchers at OpenSourceMalware identified and publicly validated this staggering number of affected repositories. While this count reflects the campaign’s broad reach, it does not confirm that every single repository experienced credential leakage or subsequent misuse, but rather highlights the potential for such exploitation.

Exploiting Trusted Developer Accounts

The attackers leverage compromised, trusted developer accounts to execute their scheme. Once they gain write access to a maintainer’s repository, they inject a malicious workflow. This workflow can be triggered either automatically upon code pushes or manually, creating a persistent backdoor. This method allows the attackers to access secrets available to the workflow, effectively transforming a stolen account into a conduit for breaching cloud systems, package registries, and other connected projects.

OpenSourceMalware researchers uncovered this latest phase of the GhostAction campaign during their investigation into a malicious PyPI package named claudecord. Their efforts to assist the package’s maintainer led to the discovery of the malicious workflow and subsequently, the extensive network of compromised repositories.

Advanced Credential Exfiltration Techniques

The newly identified malicious workflow goes beyond merely reading selected GitHub Actions secrets. It systematically scans repository files for strings resembling credentials, including AWS access keys and tokens for platforms like GitHub, GitLab, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter.

Crucially, the workflow also examines the entire reachable Git history. This allows it to discover keys that may have been removed from the current version of a file but still exist in older commits. To achieve this, the workflow utilizes fetch-depth: 0, ensuring a complete history is retrieved. It then identifies credential-like patterns and, in some instances, collects surrounding lines of text, particularly around AWS key IDs. This contextual information can provide valuable insights, such as matching secret keys or details about associated accounts and services, making the exfiltrated data even more potent.

All collected data is then transmitted to attacker-controlled infrastructure over plain HTTP. Because this data transfer originates from a CI runner, it can easily mimic legitimate build activity, making detection challenging without meticulous inspection of workflow changes and outbound network traffic.

Campaign Growth and Previous Reports

The GhostAction campaign has shown continuous growth. Previous reporting by GitGuardian indicated 772 affected repositories between August 31 and September 30, 2026. OpenSourceMalware’s more recent review, extending through October 9, identified 790 repositories, including some that may no longer be publicly accessible. In a distinct surge on October 8, Socket and StepSecurity reported activity across 346 repositories linked to two compromised accounts. These figures represent different periods and datasets and should not be combined.

The October 8 surge involved repositories belonging to the kitao and henrywoo accounts, as well as Uber’s uber/athenadriver. The malicious activity impacted active projects, forks, and even repositories that had been dormant for several years, suggesting an automated process for identifying and targeting repositories accessible by the compromised accounts. While some workflows successfully executed, as of October 9, no malicious PyPI or crates.io releases had been definitively linked to this specific burst of activity.

Why Removing the Workflow is Not Enough

Simply deleting the malicious workflow file from a repository does not mitigate the damage of a successful compromise. A workflow that has already executed could have exposed credentials. Removing the file does not automatically revoke stolen GitHub tokens, invalidate cloud or publishing keys, or eliminate credentials embedded in old commits.

Affected organizations must take comprehensive remediation steps. This includes preserving all relevant workflow files, run logs, commits, and audit records for forensic analysis. Crucially, all account credentials that allowed the malicious changes must be revoked, and every secret the workflow could have accessed must be rotated. Furthermore, teams should meticulously review package releases, deployments, and cloud activity during the compromise period for any signs of further malicious action.

GitHub’s secure use guidance for Actions emphasizes the importance of least-privilege access, thorough review of workflow code, and regular rotation of exposed secrets. Implementing approval requirements for sensitive workflow changes and restricting runner network access can provide additional layers of security.

OpenSourceMalware also identified my-github[.]com, which currently resolves to the campaign’s collection IP, as a high-priority indicator of compromise. While this domain is suspicious, researchers caution that it does not definitively prove the GhostAction operator registered it. A similarly named GitLab domain is listed as a watch item but is not confirmed campaign infrastructure. Defenders should maintain this distinction when configuring alerts.

What You Should Do

• Immediately Revoke and Rotate: If your GitHub repositories show any signs of compromise or suspicious workflow activity, immediately revoke all GitHub tokens and rotate every secret (cloud credentials, API keys, publishing tokens) that the malicious workflow could have accessed.
• Forensic Analysis: Preserve all workflow files, run logs, commits, and audit records from the affected period for thorough forensic investigation. This will help understand the extent of the breach.
• Audit and Review: Conduct a comprehensive audit of all package releases, deployments, and cloud activity originating from the compromised accounts or repositories during the period of compromise. Look for unauthorized changes or deployments.
• Implement Least Privilege: Review and enforce least-privilege access policies for GitHub Actions. Ensure workflows only have access to the secrets and resources absolutely necessary for their function.
• Code Review and Approval: Implement mandatory code reviews and approval processes for all changes to GitHub Actions workflows, especially those involving sensitive operations or external communication.
• Monitor Network Traffic: Actively monitor outbound network traffic from CI/CD runners for unusual connections or data exfiltration attempts.
• Utilize IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems and threat intelligence platforms for enhanced detection and alerting. Remember to “defang” IP addresses and domains when using them outside of controlled threat intelligence platforms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.