In the GhostAction campaign, attackers compromised about 1,900 GitHub accounts and pushed malicious workflows into more than 30,000 repositories — attempting to extract 3,174 secrets from CI in a single October 8–9, 2026 surge (per GitGuardian's research, reported October 15, 2026). The weapon is a workflow file with a reassuring name — security-audit.yml, github_actions_security.yml or security-check.yml — which quietly curls your CI secrets to an attacker server. Paste any workflow YAML below and this page checks it against the campaign's known indicators, right in your browser.
security-audit.yml, github_actions_security.yml, security-check.ymlcurl/wget piped into a shell — classic remote-script executionsecrets.* and ship them outbound via curl (the exfil pattern)fetch-depth: 0 full-history checkouts — the 2026 variant swept git history for credentials193.32.204.199 and the ?c=monami URI pathpermissions: write-all) and suspicious upload-artifact of .env files100% client-side: nothing you paste is uploaded, stored, or sent anywhere. It never leaves this browser tab.
What this check can't see: the repo's audit log, who actually pushed the file, forks, organization secrets, or secrets already sitting in git history. Those are manual checks — below.
Run these locally or in the GitHub UI. They catch what text patterns miss.
git log --diff-filter=A --name-only --format=%ci -- \ .github/workflows/security-audit.yml \ .github/workflows/github_actions_security.yml \ .github/workflows/security-check.yml
Any file added on/after 2026-10-07 by a human you can't confirm: guilty until proven innocent.
grep -rnE "fetch-depth:\s*0" .github/workflows/ grep -rnE "(curl|wget).*193\.32\.204" .github/workflows/
workflow_dispatch runs you didn't start, runs at odd hours.git.push) events where the actor isn't a recognized team member.action_required and the exfiltration never ran.Every step your CI runs with your secrets. The audit parses your workflow YAML for the GhostAction playbook: obfuscated run blocks, exfiltration to external endpoints, credential harvesting steps, and pinned-action substitutions. Paste your YAML, get a verdict per job. A clean workflow is boring — that is the point.
Three workflow file names have been confirmed across both GhostAction waves: github_actions_security.yml (the primary variant, display name "Github Actions Security"), security-check.yml (a secondary variant seen in seven repositories), and security-audit.yml (the 2026 variant that also mines the full git history). Audit all three names, and inspect any recently added workflow file not authored by a known team member.
Check .github/workflows/ for security-audit.yml, github_actions_security.yml or security-check.yml that you did not add. Search your git log for commits with messages like "Add Github Actions Security workflow" or "Add security check workflow". Review Actions run logs for workflow runs you didn't trigger, unexpected outbound HTTP requests, and commits made in your identity that you don't recognize — every GhostAction commit used the victim's own identity.
In Actions run logs, look for curl or wget commands that were not part of your original workflow definition — specifically outbound HTTP POST requests to 193.32.204.199 or URIs containing /?c=monami. At the repo level, use the GitHub audit log to find workflow-file creation (git.push) events where the actor isn't a recognized team member, and monitor for new .github/workflows/ files committed without pull-request review.
Treat it as an active compromise, not a close call. Revoke and rotate ALL repository and organization secrets first — anything the workflow could read is already exfiltrated, so deleting the file alone changes nothing. Then remove the workflow from every branch, revoke the GitHub credential that pushed it, review Actions logs for the "Audit" step to see if exfiltration ran, and check forks — injected workflows persist in forks long after the original is cleaned.
Require pull-request review for any change to .github/workflows/ (this alone makes silent injection impossible without a paper trail), enable "require approval for all outside collaborators" for workflow runs, pin third-party actions to commit SHAs instead of floating tags, scope secrets so each workflow reads only what it needs, and rotate personal access tokens — stolen PATs from infostealer logs were the attackers' way in. One documented case shows the run-approval gate stopped the exfiltration mid-execution.