GhostAction Hackers Compromise 500+ GitHub Accounts to Steal API Credentials

GhostAction threat actors have compromised more than 500 GitHub accounts to steal sensitive cloud and artificial intelligence credentials, according to a report by GBHackers. This expansion of activity has occurred since October 7, 2026, marking a significant increase in the scale of the ongoing campaign.

The attackers have injected malicious workflows into tens of thousands of repositories during this period, as reported by GBHackers. This widespread injection allows the threat actors to execute unauthorized commands within the continuous integration and continuous deployment pipelines of affected organizations.

Campaign Scope and Methodology

Socket provided an update on October 9, 2026, describing the operation as a targeted credential theft campaign. The group specifically targets GitHub Actions secrets, which are often used to store sensitive authentication data for automated build and deployment processes.

According to the Socket update, the attackers are also extracting cloud credentials and AI service API keys. These keys are frequently embedded directly in source code or left exposed in repository history, making them vulnerable to automated scraping and theft.

Targeted Assets and Risks

The primary targets of this operation are GitHub Actions secrets, which serve as critical access points for infrastructure management. Compromise of these secrets can lead to unauthorized access to cloud environments, data breaches, and further lateral movement within victim networks.

AI service API keys are another major focus, as noted in the Socket report. These keys often grant access to expensive computational resources or sensitive data processing capabilities, making them highly valuable to threat actors seeking to monetize their access or disrupt services.

What should you do?

Security teams should immediately audit their GitHub repositories for unauthorized workflow changes. Organizations must review commit histories for any unexpected modifications to action files or secret configurations, especially those occurring around October 2026.

Administrators should rotate all GitHub Actions secrets and associated cloud credentials immediately. Any key that may have been exposed in source code or repository history should be considered compromised and replaced to prevent further unauthorized access.

What to do and how to stay safe: GhostAction

• Audit GitHub Actions workflows for unauthorized changes or new files added by unknown contributors.
• Rotate all GitHub Actions secrets and cloud provider credentials immediately to invalidate potentially stolen keys.
• Review repository commit history for any instances where API keys or secrets were committed to source code.
• Monitor cloud infrastructure logs for unusual activity or access patterns originating from compromised CI/CD pipelines.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many GitHub accounts have been compromised by GhostAction?

More than 500 GitHub accounts have been compromised as part of the GhostAction campaign, according to GBHackers.

When did this specific expansion of the campaign begin?

The campaign expanded to include over 500 compromised accounts starting on October 7, 2026, per GBHackers.

What specific credentials are the attackers stealing?

Attackers are stealing GitHub Actions secrets, cloud credentials, and AI service API keys, according to Socket’s October 9 update.