In the GhostAction campaign, attackers compromised about 1,900 GitHub accounts and pushed malicious workflows into more than 30,000 repositories across 3,000 users and organizations — attempting to extract 3,174 secrets from CI in a single October 8–9, 2026 surge (per GitGuardian's research, reported October 15, 2026). The weapon is a workflow file with a reassuring name — security-audit.yml or github_actions_security.yml — pushed in your identity, which quietly sends your CI secrets to an attacker server. The original wave, first documented in September 2025, already exfiltrated at least 3,325 secrets from 817 repositories. This free interactive 7-step CI self-audit walks you through checking your workflows, secret access and run history in minutes. It's a guided audit you perform yourself — it does not scan your repositories.
security-audit.yml (2026 variant), github_actions_security.yml, and security-check.yml — all exfiltrating via curl POST to attacker infrastructure. Decryption Digest.Yes — immediately, before deleting the workflow. Any secret the workflow could read may already be copied: GitHub treats potentially exposed credentials as compromised. Rotate every repo and organization secret the workflow could reach, check for rogue repos or commits made in your identity, then remove the workflow from all branches.
Per GitGuardian's research, reported by The Hacker News on October 15, 2026 (thehackernews.com/2026/10/ghostaction-compromises-about-1900.html).
Per OpenSourceMalware researcher Jenn Gile (reported by The Hacker News, GBHackers, October 16–19, 2026). Discovered by Thijs Xhaflaire (Jamf Threat Labs) while hunting PolinRider infections.
.vscode/tasks.json with runOn: folderOpen — auto-runs when the folder opens in VS Code (task labeled "eslint-check", terminal visibility suppressed); (2) public/fonts/fa-solid-400.woff2 — not a font: 38 lines of unobfuscated Node.js credential stealer; (3) a second GitHub Actions workflow as a fallback if the stealer never runs (names seen: lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml — expanded credential formats plus a fallback upload to a secret gist).193.32.204.199.#ghc2). Deleting the repo files does NOT remove the cron foothold.my-github[.]com and sent fake GitHub security alerts harvesting credentials and 2FA codes; the infrastructure can also abuse GitHub OAuth to obtain repo and workflow tokens.Tick each step as you complete it. Progress is saved on this device only (localStorage) — nothing is sent anywhere.
0 of 7 steps complete
This is a guided self-audit, not an automated scanner: you review your own repositories, and nothing about your repos leaves your browser. Informational only, not security advice.
GhostAction is a GitHub supply-chain credential-theft campaign first documented by GitGuardian in September 2025. It escalated sharply on October 8–9, 2026: attackers compromised about 1,900 GitHub accounts and pushed malicious workflows into more than 30,000 repositories across 3,000 users and organizations, attempting to extract 3,174 secrets from public repositories' CI. The original 2025 wave hit 817 repositories across 327 users and exfiltrated at least 3,325 secrets.
Three distinct workflow file names have been confirmed across the GhostAction waves: security-audit.yml (the 2026 variant, which also mines full git history), github_actions_security.yml (display name 'Github Actions Security'), and security-check.yml (display name 'Security Check'). All three trigger on push events and exfiltrate secrets via curl to attacker infrastructure. (Per Decryption Digest and StepSecurity, Oct 2026.)
Look for: a security-audit.yml or github_actions_security.yml workflow you did not add; commits to workflow files you didn't author (commit messages seen include 'Add security audit workflow' and 'Update security audit workflow'); workflow runs you didn't trigger, especially workflow_dispatch runs; and any commits made in your identity that you don't recognize — every GhostAction commit was made with the victim's own identity.
If the malicious workflow executed successfully, any secret available to it may already have been copied by the attacker. GitHub's incident-response guidance recommends treating potentially exposed credentials as compromised: revoke or rotate the affected credentials first, then remove the workflow from all branches. Cleanup alone does not end the threat. (Per CyberUpdates365 and GitHub guidance.)
The 7-step audit above covers the essentials: know every file in .github/workflows, review workflow-file commits and run history for anomalies, scope secrets so each workflow only reads what it needs, pin third-party actions to commit SHAs instead of floating tags, keep repository access least-privilege, and rotate personal access tokens regularly — stolen PATs were the attackers' way in.
The second stage commits three files: .vscode/tasks.json (a VS Code task labeled "eslint-check" with runOn: folderOpen and a hidden terminal), public/fonts/fa-solid-400.woff2 (38 lines of unobfuscated Node.js — not a font), and a fallback GitHub Actions workflow. When the folder opens in a trusted VS Code workspace with automatic tasks allowed, the stealer runs: it harvests AWS keys, PyPI/npm tokens, Git logins, Kubernetes credentials, SSH private keys (RSA + Ed25519 in full), and Anthropic Claude / Google Gemini credentials via a recursive home-directory hunt, exfiltrating over HTTP port 8080 to 193.32.204.199. It also installs a cron job (marker #ghc2) fetching and running attacker code every 5 minutes — so deleting the repo files does not remove the foothold. OpenSourceMalware found it in 94 repos across 66 owners (October 2026). (Per OpenSourceMalware, The Hacker News, GBHackers.)
The Hacker News report (October 15, 2026) carries GitGuardian's research: the 1,900 compromised accounts, the 30,000+ targeted repositories, and how the fake "security audit" workflows exfiltrated CI secrets.