GitHub Attack: 1,900 Accounts and 30,000 Repos Compromised

GitHub, the most widely used collaborative development platform, has suffered a significant attack. The attackers managed to access approximately 1,900 accounts and, from them, modified workflows in more than 30,000 repositories. The objective: to steal CI/CD credentials, cloud access keys, and API tokens from AI providers. The campaign, named GhostAction by GitGuardian, intensified especially on October 8 and 9, when the attackers reached repositories of about 3,000 users and organizations, attempting to extract 3,174 secrets.

This incident does not exploit a vulnerability in GitHub Actions; rather, the attackers used stolen developer credentials to directly modify the workflows. According to StepSecurity's analysis on October 9, personal access tokens (PATs) obtained from credential dumps were likely the source, although the initial compromise has not been confirmed.

The attackers added malicious workflows with names that simulated security tasks, such as security-audit.yml or github_actions_security.yml. These workflows referenced secrets already used by legitimate builds, which allowed them to collect those credentials during their execution and send them to a server controlled by the attackers.

Beyond explicit secrets

The October variant went beyond the secrets explicitly referenced by the workflows. Using actions/checkout@v4 with fetch-depth: 0, the attackers scanned the working tree and the entire Git history for AWS keys, GitHub and GitLab tokens, Google and Firebase keys, and API tokens from Anthropic, OpenAI, and OpenRouter. Later versions captured surrounding lines to match AWS key IDs with their corresponding secret access keys. The collected credentials were sent via HTTP to the address 193.32.204.199, including keys removed from the current code but still present in the Git history.

GitHub blocked the malicious workflows, but the damage was already done. The total number of stolen credentials remains unknown. GitGuardian counted 3,174 secrets targeted for extraction and confirmed some exfiltration during the October campaign, but did not determine how many distinct credentials reached the attackers. In the August and September campaign, GitGuardian identified malicious workflows in 772 public repositories of 373 users and organizations. Of the 3,669 workflow runs recorded in 605 repositories, only 499 executed, and 336 successfully completed the exfiltration of 26 secrets from 13 repositories.

GitHub's approval controls stopped most of the malicious workflows, but the attackers simply recycled 92 old ones left over from previous attacks, including infrastructure active since September 2025. To make matters worse, GitGuardian discovered that, by October 5, only 16% of the affected repositories (124 of 772) had been cleaned.

What does this mean for your SMB?

If your company uses GitHub to host code, even in private repositories, this attack is a wake-up call. The attackers do not need to exploit a complex vulnerability; they just need to obtain developer credentials to seed malicious workflows that steal secrets. In an SMB, where credentials are often shared and changes to workflows are not thoroughly reviewed, the risk is high.

Furthermore, the theft of cloud keys and AI API tokens can have serious consequences: from unauthorized access to cloud resources to unexpected costs due to fraudulent use of AI services. The exposure of these credentials can go unnoticed for months, as attackers can use them stealthily.

Recommendations to protect your organization

Based on the analysis by GitGuardian and StepSecurity, these are the actions we recommend implementing immediately:

• Review your repositories' workflows: Look for files such as security-audit.yml or github_actions_security.yml that you do not recognize. Check the change history in .github/workflows/ and verify that each modification is legitimate.
• Rotate all exposed credentials: If you suspect that any secret may have been exfiltrated, change it immediately. This includes AWS keys, GitHub, GitLab, Google, Firebase tokens, and any API key from AI providers. Do not limit yourself to current secrets: review the Git history in case there are old credentials that are still valid.
• Revoke access for compromised accounts: Even if you have removed a malicious workflow, if an account with write permissions was compromised, revoke its credentials and review its recent activity.
• Audit GitHub logs: Audit logs and PAT activity can help you identify which accounts modified the workflows and which secrets may have been compromised.
• Implement the principle of least privilege: Limit the permissions of personal access tokens and service accounts. Use short-lived tokens and periodically review access.
• Monitor secret usage: Set up alerts to detect unusual access to secrets or exfiltration attempts.

This incident underscores the importance of security in the software supply chain. It is not enough to trust the platform's measures; organizations must adopt a proactive stance. At ForgeNEX, we recommend periodically reviewing CI/CD configurations and training developers in security best practices. If you need help auditing your repositories or implementing controls, our team can assist you.

Security is a continuous process. Attacks like GhostAction demonstrate that attackers are constantly evolving. Stay informed and protect your digital assets.

Source: The New Stack. Analysis and adaptation: ForgeNEX.