GhostAction Campaign Targets Hundreds of GitHub Repos for Cloud and AI Credentials

Researchers at Socket published findings on a new wave of the GhostAction malware campaign targeting hundreds of GitHub repositories. This latest iteration expands the scope of credential theft to include cloud and artificial intelligence credentials, moving beyond previous focuses on CI/CD secrets. The activity was identified through analysis of repository data and commit histories.

The GhostAction malware operates by injecting malicious scripts into GitHub Actions workflows. These scripts execute when pull requests are merged or other triggers occur, harvesting sensitive data from the environment. According to the research published by Socket, the stolen data now includes cloud provider credentials and AI service keys, in addition to traditional CI/CD secrets.

Expansion of Targeted Credentials

The evolution of the GhostAction campaign represents a significant shift in the types of secrets attackers are prioritizing. Previously, the malware primarily targeted continuous integration and deployment secrets. The new wave specifically seeks out cloud credentials and AI-related authentication tokens. This expansion increases the potential impact of a successful compromise, as stolen cloud keys can lead to infrastructure takeover.

Researchers noted that the malware extracts these credentials from both the current source code and the git history. This means that even if a developer removes a secret from the active codebase, the malware can still retrieve it from previous commits. The ability to scrape git history allows attackers to find credentials that were accidentally committed and later deleted.

Scope and Affected Repositories

The scale of this latest GhostAction wave is substantial, with researchers identifying affected repositories in the hundreds. The campaign targets public and private GitHub repositories that utilize GitHub Actions for automation. The widespread nature of the attack suggests automated tools are being used to scan for vulnerable workflows and inject the malicious code.

The presence of the malware in git history indicates that the infection may have occurred in earlier commits. Developers who have not audited their full repository history may be unaware that their credentials have been exposed. The research highlights the importance of monitoring not just current files, but the entire commit log for suspicious actions or unexpected workflow changes.

What should you do?

Organizations should immediately audit their GitHub repositories for unauthorized workflow files or unexpected commits. Security teams need to rotate any cloud, AI, or CI/CD credentials that may have been exposed in git history. It is critical to review access logs for cloud services to detect any unauthorized usage following a potential compromise.

What to do and how to stay safe: GhostAction

• Audit GitHub Actions workflows for unauthorized scripts or unexpected changes in recent commits.
• Rotate all cloud provider credentials, AI service keys, and CI/CD secrets that may have been exposed.
• Review git history for repositories to identify any previously committed secrets that were not properly removed.
• Monitor cloud service logs for unusual activity or unauthorized access attempts using stolen credentials.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new types of credentials is GhostAction stealing?

The new wave of GhostAction is stealing cloud credentials and AI service keys, in addition to CI/CD secrets.

Does the malware only look at current source code?

No, the malware also extracts credentials from git history, including secrets that were previously committed and deleted.

How many repositories have been affected?

Researchers identified the activity in hundreds of GitHub repositories.