GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials

A new wave of the GhostAction campaign has hit more than 500 GitHub accounts. The attackers use those accounts to plant a fake security workflow in tens of thousands of repositories, and the workflow steals cloud, AI, and publishing keys.

Security firm Socket reports that the accounts added the malicious file starting October 7, 2026, and that some of the repositories belong to large organizations.

GhostAction GitHub account compromise

Socket studied a burst on October 8, 2026. Two hijacked accounts, henrywoo and kitao, pushed a file named security-audit.yml into 346 repositories.

The commit messages were “Add security audit workflow” and “Update security audit workflow.” Despite the name, the file does no security work. It collects secrets and sends them in plain text to the IP address 193.32.204[.]199.

The list of targets includes uber/athenadriver, which is owned by Uber, and kitao/pyxel, a popular Python game engine with more than 18,000 stars. The henrywoo account has write access to the Uber project because he is its original author.

This shows why one stolen maintainer account is so costly. The damage reaches every repository the account can edit, not just the owner’s own projects.

The attackers first get a working login for a maintainer account. Socket did not see how they did this. Next, they scan each repository for the secret names its workflows already use, and they write those names into the fake file.

Last, they commit the file straight to the default branch, where it runs on the next push. The same file went into hundreds of repositories within minutes, so Socket believes a tool did the work and not a person.

The timing supports that view. The henrywoo changes landed in a window of about 16 minutes, and the kitao changes landed in a four-minute window. Even repositories that had sat idle for a decade got the file.

You can read how this campaign grew in our earlier GhostAction coverage of the 772-repository wave, which tracked the same weak spot in GitHub Actions.

According to technical research published by Socket, earlier GhostAction waves only took secrets stored in GitHub Actions. GitGuardian first described that style in September 2025, when 327 users and 817 repositories lost 3,325 secrets.

The new version keeps that trick and adds a search through the repository files and the full git history.

This matters because many developers delete a key from the latest file and think the problem is gone. The old commit still holds the key.

The workflow uses a setting called fetch-depth: 0, which pulls every branch and tag so the script can read the whole past of the project.

The script looks for 13 types of keys. These include AWS access keys and session tokens, plus OpenAI, Anthropic, and OpenRouter API keys. It also looks for GitHub and GitLab tokens, Google and Firebase keys, Slack tokens, and SendGrid keys.

One detail shows the AWS focus. An AWS key ID alone cannot log in to anything. The secret half usually sits a line or two away in an .env file or a Terraform file.

So the script also copies two lines above and below each key ID. That lets the attacker rebuild a full, usable AWS key pair.

Stolen publishing tokens are just as risky. For Pyxel, the named secrets were tokens for PyPI and crates.io plus a GitHub personal access token. With those, an attacker could push a bad update of a package that many people trust.

As of October 9, 2026, the file was still on the default branch of the repositories Socket checked. The workflow had also run successfully, which means data could already have left.

Socket saw no bad package versions on PyPI or crates.io at the time of writing, but that does not prove the stolen keys went unused.

Forks add more risk. Socket counted 279 forks under the henrywoo name that carry the file, and Actions can run it on later pushes if they are enabled.

Machine learning projects such as henrywoo/pyllama and henrywoo/chatllama stand out, since their users often hold AWS and AI keys.

The campaign has kept growing. OpenSourceMalware counted 790 repositories with the workflow through October 9, 2026, which our team covered in a report on 790 hijacked GitHub repositories. AI tools can make exposed keys even more dangerous.

Microsoft says attackers used an AI framework called ARTEX to find GitHub secrets and reach Azure Key Vault in about five minutes, as shown in our ARTEX AI report.

Start by opening .github/workflows/security-audit.yml and checking which secret names it lists. Rotate every secret named there.

For a GitHub personal access token, revoke it and make a new one. Then review the Actions run history and treat every finished run as a successful theft.

Next, scan the full git history with git log -p –all and rotate every key you find, even if it no longer shows in the current files. For AWS keys, check CloudTrail for new IAM users, new access keys, and use in odd regions.

Treat the maintainer account as fully compromised. Revoke all sessions, tokens, OAuth grants, and SSH keys. Turn on phishing-resistant multi-factor login, then search the organization audit log for new workflow files.

Block 193.32.204[.]199 in egress logs, including self-hosted runners. Finally, turn on GitHub secret scanning with push protection and require approval for workflow runs from outside contributors.

The post GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials appeared first on Cyber Security News.