A recent GhostAction campaign has compromised 346 GitHub repositories after cybercriminals hijacked two maintainer accounts to introduce a fraudulent 'security audit' workflow. This malicious workflow was designed to extract CI/CD secrets, cloud keys, API tokens, and other sensitive credentials from the compromised repositories' source-code history. Security firm Socket discovered that this activity, which occurred on October 8, targeted repositories connected to GitHub accounts henrywoo and kitao. Notable among the affected repositories are Uber’s uber/athenadriver and the popular kitao/pyxel project, boasting over 18,000 GitHub stars. The attackers introduced the malicious file named .github/workflows/security-audit.yml through commits labeled 'Add security audit workflow' and 'Update security audit workflow'. Once the attackers have write access to a maintainer account, they can deploy a GitHub Actions workflow across any repository the account can modify. This workflow activates automatically when developers push code, granting attackers access to sensitive CI/CD credentials. Socket's investigation revealed that the malicious workflow transmitted stolen data via an HTTP POST request to 193.32.204[.]199. It targeted GitHub Actions secrets such as PyPI passwords, crates.io tokens, GitHub personal access tokens, and various package publishing credentials. The latest iteration of GhostAction also searches active repository files and the full Git history for hardcoded secrets. This advancement is significant because developers might remove keys from current files while leaving them exposed in older commits. The workflow employs fetch-depth: 0 to download the entire repository history before conducting its searches. It seeks out AWS access key IDs, AWS secret keys, temporary session tokens, and a multitude of other tokens and credentials. The activity appears to be highly automated. Socket identified 318 affected repositories under the henrywoo namespace, including 279 forks, and 27 repositories under kitao and Uber’s athenadriver. The commits were made in quick succession, even affecting dormant repositories untouched for years, suggesting the operator relied on automated repository discovery. According to earlier findings by GitGuardian, the GhostAction campaign had previously compromised 817 repositories and pilfered more than 3,325 secrets. A subsequent wave from late August to September 2026 affected 772 public repositories, targeting 2,577 secrets. While the older payload focused solely on GitHub Actions secrets, this latest version also seeks credentials embedded in source code and historical commits. The repercussions could extend beyond the compromised repositories. Stolen credentials for platforms like PyPI, npm, Docker Hub, or crates.io could enable an attacker to distribute a malicious update from a trusted project. This risk is particularly severe for popular open-source libraries, as a malicious release might spread to downstream developers and production systems. As of October 9, Socket reported no malicious packages published to PyPI or crates.io from this campaign. However, maintainers should consider any successful workflow run a potential credential exposure. Revoking GitHub sessions, personal access tokens, OAuth grants, SSH keys, and all secrets mentioned in the malicious workflow is crucial. Additionally, scanning the entire Git history, reviewing GitHub Actions run records, inspecting package release histories, and checking network logs for traffic to 193.32.204[.]199 are essential steps. Implementing GitHub secret scanning with push protection, enforcing strict branch rules for .github/workflows changes, and adhering to least-privilege permissions can mitigate future risks.