Source: socket.dev
On October 8, 2026, the GhostAction campaign returned with a new wave targeting 346 GitHub repositories by compromising two maintainer accounts (henrywoo and kitao) and injecting a malicious workflow file named security-audit.yml. The campaign expanded beyond its original GitHub Actions secret theft to also sweep working trees and full git history for cloud provider and AI service credentials using 13 regex patterns. Stolen data was exfiltrated via HTTP POST to a hardcoded C2 IP address (193.32.204.199). High-profile repositories affected include uber/athenadriver and kitao/pyxel (18,420 stars), with publishing credentials for PyPI and crates.io at risk. The attack was highly automated, processing 346 repos across two accounts in short time windows. The new variant adds fetch-depth:0 to retrieve complete git history including credentials developers believed were deleted. Targeted credential types include AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys, Slack tokens, and SendGrid keys. No malicious package versions were observed published to PyPI or crates.io at time of writing.
