GitHub CI/CD Workflows: GhostAction Exfiltrates Secrets from 346 Repos via Stolen Maintainer Credentials
Threat actors used stolen maintainer credentials to inject malicious workflows that exfiltrate CI/CD secrets and hardcoded keys from source code history.
Key points
- The campaign compromised 346 repositories by adding fake security audit workflows to hijacked GitHub accounts.
- Malicious scripts search full Git history for hardcoded secrets like AWS keys and API tokens.
- Targets include high-profile projects such as Uber’s athenadriver and the popular pyxel library.
Security firm Socket reported on October 8 that a new GhostAction campaign had compromised 346 GitHub repositories. Threat actors executed this attack by hijacking two maintainer accounts and inserting malicious workflows designed to steal credentials. The activity targeted repositories connected to the GitHub accounts henrywoo and kitao.
The attackers added a file named .github/workflows/security-audit.yml through commits labeled “Add security audit workflow” and “Update security audit workflow.” This file triggers automatically when developers push code to the repository. The workflow then sends stolen data via an HTTP POST request to the IP address 193.32.204[.]199.
How the Attack Works
The malicious workflow collects GitHub Actions secrets referenced by existing project workflows. These include PyPI passwords, crates.io tokens, GitHub personal access tokens, and package publishing credentials. The script also searches active repository files and the full Git history for hardcoded secrets. This approach targets keys that developers may have removed from current files but left exposed in older commits, branches, or tags.
To ensure it scans the entire history, the workflow uses the fetch-depth: 0 setting. This downloads the complete repository history before running searches against it. Researchers found the payload looks for AWS access key IDs, secret keys, and temporary session tokens. It also captures surrounding lines near AWS key IDs to help attackers locate matching secret keys.
Who Is Affected
The activity appears highly automated and targeted both active and inactive repositories. Socket observed 318 affected repositories under the henrywoo namespace, which included 279 forks. An additional 27 repositories were affected under the kitao account. Notable targets include Uber’s uber/athenadriver repository and the kitao/pyxel project, which has more than 18,000 GitHub stars. The commits were pushed across short time windows, including repositories that had not received changes for years.
Our take on the response
The campaign demonstrates how a single stolen maintainer account can expose a wide network of repositories. Once attackers gain write access, they can add workflows to every repository the account can modify. That suggests organizations must treat maintainer account security as a critical control point for supply chain integrity. No fix has been confirmed yet for the compromised accounts themselves.
What to do and how to stay safe: GitHub
- Audit all GitHub Actions workflows in your repositories to identify any unauthorized or unfamiliar files, especially those added by external maintainers.
- Rotate all CI/CD secrets, API tokens, and credentials that may have been exposed in your repository history or workflow environment variables.
- Review commit history for recent changes to workflow files, particularly those using fetch-depth: 0 or making external HTTP requests.
- Enable branch protection rules that require pull request reviews for changes to workflow files and restrict write access to trusted maintainers only.
Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific repositories were compromised in this GhostAction campaign?
The campaign affected 346 repositories, including Uber’s uber/athenadriver and the kitao/pyxel project, as well as 279 forks under the henrywoo account.
How did the attackers exfiltrate data from the repositories?
The malicious workflow sent stolen data through an HTTP POST request to the IP address 193.32.204[.]199 after collecting secrets and hardcoded keys.
Does this attack only look at current files for secrets?
No, the workflow searches the full Git history, including older commits, branches, and tags, by using fetch-depth: 0 to download complete history.
