GhostAction Attack Compromises 346 GitHub Repos via Hijacked Maintainer Accounts
Threat actors used stolen maintainer credentials to inject malicious workflows into hundreds of repositories, stealing secrets and cloud keys.
Key points
- Attackers compromised 346 repositories using two hijacked maintainer accounts, henrywoo and kitao.
- Malicious workflows steal CI/CD secrets, API tokens, and credentials from current files and Git history.
- Targets include Uber’s athenadriver repo and the popular pyxel project with over 18,000 stars.
Threat actors compromised 346 GitHub repositories on October 8 by leveraging two hijacked maintainer accounts to inject malicious workflows. According to security firm Socket, the campaign targeted repositories connected to the accounts henrywoo and kitao, aiming to steal sensitive credentials.
The attackers added a fake “security audit” workflow to the affected repositories. This malicious file, named .github/workflows/security-audit.yml, was introduced through commits titled “Add security audit workflow” and “Update security audit workflow.” The campaign demonstrates how stolen maintainer access can expose multiple repositories simultaneously.
Technical Execution and Scope
The malicious workflow executes automatically when developers push code to the repository. According to Socket’s GhostAction investigation, the script sends stolen data via an HTTP POST request to the IP address 193.32.204[.]199. The payload collects GitHub Actions secrets referenced by existing project workflows, including PyPI passwords and GitHub personal access tokens.
The newer GhostAction version searches both active repository files and the full Git history for hardcoded secrets. It uses fetch-depth: 0 to download the complete repository history before running searches. This allows attackers to find keys that developers may have removed from current files but left exposed in older commits, branches, or tags.
Researchers identified that the payload looks for AWS access key IDs, secret keys, and temporary session tokens. It also targets GitHub and GitLab access tokens, Google API keys, Slack tokens, SendGrid credentials, and API keys for OpenAI, Anthropic, and OpenRouter. The script captures surrounding lines near AWS key IDs to help attackers locate matching secret keys.
Affected Repositories and Targets
Socket observed 318 affected repositories under the henrywoo namespace, including 279 forks. Another 27 repositories were compromised under the kitao account, along with Uber’s uber/athenadriver repository. The targets include the popular kitao/pyxel project, which has more than 18,000 GitHub stars.
The activity appears highly automated, with commits pushed across short time windows. Attackers targeted inactive repositories that had not received changes for years. This widespread modification shows how write access allows attackers to add workflows to every repository an account can modify, placing CI/CD credentials within reach.
What should you do?
Security teams should monitor for unauthorized workflow additions in their repositories. Organizations should rotate any credentials that may have been exposed in Git history. Developers should review maintainer account permissions and enable additional verification steps for sensitive actions.
What to do and how to stay safe: GitHub
- Audit repository permissions to ensure only trusted maintainers have write access to workflow files.
- Scan Git history for hardcoded secrets using tools that detect exposed credentials in previous commits.
- Rotate all API tokens, cloud keys, and CI/CD secrets that may have been accessible to compromised accounts.
- Monitor for unusual outbound HTTP POST requests from CI/CD environments to unknown IP addresses.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many repositories were compromised in this GhostAction attack?
A total of 346 GitHub repositories were compromised, including 318 under the henrywoo account and 27 under kitao.
What specific data does the malicious workflow steal?
It steals CI/CD secrets, cloud keys, API tokens, and credentials from source-code history, including AWS keys and GitHub tokens.
Which notable projects were affected by this campaign?
Uber’s uber/athenadriver repository and the popular kitao/pyxel project, which has over 18,000 stars, were among the targets.
