GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

GhostAction, a known threat campaign, has returned with a new attack vector targeting GitHub repositories. Compromised maintainers are pushing a fake 'security-audit.yml' workflow file into repositories. This malicious workflow is designed to steal CI/CD secrets and cloud credentials from GitHub Actions environments. The attack mines credentials from entire Git histories, significantly expanding the scope of potential data exfiltration. The campaign targets developers and organizations relying on GitHub Actions for their CI/CD pipelines. The use of a legitimate-sounding filename ('security-audit.yml') is a social engineering tactic to evade suspicion. This represents a supply chain attack vector, as compromised maintainers serve as the initial access point. Organizations using GitHub Actions for cloud deployments are at elevated risk of credential compromise and subsequent cloud infrastructure breach.