Cybersecurity experts have uncovered a significant credential theft operation targeting GitHub repositories. The campaign, attributed to a group identified as GhostAction, involved the use of compromised accounts belonging to well-known open-source maintainers. The attackers leveraged these accounts to introduce malicious GitHub Actions workflows into over 340 repositories. Specifically, the account of Takashi Kitao, creator of the popular Pyxel game engine, was used to distribute the harmful workflow across 27 repositories. Hours later, Henry Wu's account, associated with Uber's athenadriver, was exploited to spread the same workflow to 318 additional repositories.

Since the campaign's emergence on October 7, 2026, over 500 GitHub accounts have been implicated, affecting tens of thousands of repositories. This attack, part of the larger GhostAction campaign first identified in September 2025, has resulted in the exfiltration of over 3,300 secrets. These include critical credentials such as PyPI, npm, DockerHub tokens, as well as cloud and API keys.

The malicious workflows, named Security Audit or GitHub Actions Security, were designed to siphon sensitive data to a specific IP address via plain HTTP. Key information targeted includes CI/CD secrets, AWS keys, and API tokens for various cloud and AI services. In a related incident on August 30, 2026, attackers also embedded a cryptocurrency miner into a Docker image via a compromised repository.

Developers are urged to inspect their repositories for these malicious workflows dating back to August 31, 2026. Immediate actions include revoking and rotating compromised credentials, removing the malicious workflows, and examining all forks of affected repositories. Forks, especially private ones, pose significant risk as they may carry the malicious code, potentially leading to further credential exposure.