GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

What it is

A new wave of the GhostAction GitHub Actions credential-theft campaign. On October 8, 2026, attackers using compromised maintainer accounts (kitao/pyxel, and henrywoo with write access to uber/athenadriver) committed a "Security Audit" workflow (security-audit.yml) straight to default branches. The earlier variant is named "Github Actions Security" (github_actions_security.yml). As of October 9, code search shows 378 repositories with a live malicious workflow, and henrywoo's 279 infected forks sit on top of that.

How it works

• The workflow triggers on workflow_dispatch and any unfiltered push, and checks out with fetch-depth: 0.
• It templates the repo's named ${{ secrets.* }} into the payload, based on prior reconnaissance of the workflow files.
• It greps the working tree and git log -p --all for 13 credential patterns. A secret committed and deleted years ago is still harvested.
• It captures ±2 lines around AWS key hits, delimited by AKIA_CTX_START…AKIA_CTX_END, to pair key IDs with secret keys.
• It POSTs everything over plain HTTP to 193.32.204.199. The ?c=monami marker means named secrets were found, and ?c=new means none were. No DNS lookup occurs.
• The GITHUB_TOKEN in the athenadriver run was contents: read. Escalation depends on the stolen secrets.

Preconditions / Affected

Any repository where either workflow file appeared since August 31, 2026. The page says to treat that as a confirmed breach. The workflow beacons even when it finds nothing.

What to do

Search GitHub code (logged in, Code tab):

"AKIA_CTX_START" path:.github/workflows
"c=monami"
"193.32.204.199" path:.github/workflows
org:your-org "AKIA_CTX_START"
org:your-org "c=monami"
org:your-org "193.32.204.199"

• Audit logs: look for maintainer commits adding these workflows directly to default branches without a PR, workflow_dispatch on new "audit" workflows, and unsigned rapid-fire commits across many repos.
• Rotate every credential ever committed to the repo, not just current Actions secrets. Registry and publishing tokens (PyPI, crates.io) are the priority.
• Require approval for workflow runs. In typecho-fans/plugins this stopped exfiltration: the runs stalled in action_required.
• Add an egress allowlist on runners. Raw-IP traffic evades domain-based controls.
• Protect .github/workflows/* with branch protection so changes need PR review.
• Harden-Runner users: filter telemetry since early September 2026 for destination 193.32.204.199 on ports 80 and 3000.

Caveats

• Exfiltration is confirmed only in the uber/athenadriver run log, where the server replied OK four seconds after the run started. The pyxel workflow ran five times, all successful.
• The AWS secret-key regex partly misfires because POSIX ERE rejects (?:...), so it under-matches. The literal-prefix patterns work.
• The 378, 182 and 88 counts are approximate and drift as victims clean up. Code search covers default branches only and excludes forks.
• No malicious package releases from stolen publishing credentials had been seen. The page says this is not evidence the credentials are safe.
• The account-compromise vector (a leaked PAT) is described as "most plausibly", not confirmed.