GhostAction Is Back: a Fake 'Security Audit' Workflow Now Mines Git History for Deleted Secrets

A GitHub Actions workflow named "Security Audit" that scans a repository's entire commit history for credentials was pushed to 345 repositories on October 8 through two hijacked maintainer accounts, StepSecurity reported. It is the second wave of the GhostAction campaign, and it changes what a victim has to rotate.

A repository owner who finds security-audit.yml or github_actions_security.yml on any branch should treat it as a confirmed breach, revoke the GitHub credential that planted it, and rotate every secret ever committed, not only the current Actions secrets.

What the new workflow does

StepSecurity's Rohan Prabhu describes two variants. The older one runs a send-secrets job that POSTs the repository's named Actions secrets over plain HTTP to a hard-coded server. The October variant, named "Security Audit", triggers on manual dispatch and on a push to any branch or tag, and checks out the full history with fetch-depth: 0.

It searches the working tree for 13 credential patterns, covering AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack and SendGrid keys. It then runs git log -p --all, so a key that a developer committed and later deleted is still found. It pairs AWS key IDs with their secret keys and sends everything in one request to 193.32.204.199.

StepSecurity's own advice is blunt: "Rotating current Actions secrets no longer addresses this exposure." GitGuardian, which tracked the first 2026 wave, reached the same conclusion independently: "Rotating the secrets exfiltrated by the malicious workflow is not enough."

Two accounts, 345 repositories, one afternoon

On October 8 the attacker used the account of Takashi Kitao, author of the pyxel game engine, to push the workflow to 27 repositories between 13:20 and 13:44 UTC. At 21:10 UTC the account of Henry Wu (henrywoo), original author of Uber's athenadriver, pushed it to 318 repositories in 16 minutes. Of those, 279 are forks. StepSecurity says these are victim accounts, not attacker-owned handles.

StepSecurity's run log from uber/athenadriver shows the server acknowledging receipt about four seconds after the run began. The workflow's GITHUB_TOKEN was read-only, so any escalation depends on what the stolen secrets unlock. In the pyxel repository the attacker re-triggered the workflow by hand twice.

The one control that worked was an approval gate. On October 7 the attacker pushed empty commits to typecho-fans/plugins to re-trigger a workflow, and the runs stalled awaiting approval, so nothing was sent. StepSecurity calls that setting "the single control observed stopping this campaign's exfiltration this week".

How big it is, by who is counting

Source	Figure	Period
StepSecurity	378 repositories with a live malicious workflow on the default branch	As of October 9
StepSecurity	182 with the history-mining marker, 88 with the named-secrets marker	As of October 9
GitGuardian	772 public repositories, 373 users and organisations	August 31 to September 30
GitGuardian	2,577 secret names targeted	August 31 to September 30

GitGuardian's remediation figure is the harder one to read: only 124 of the 772 repositories (16%) had been cleaned in observed public history by October 5. Of 3,669 workflow runs across 605 repositories, 499 executed, in 32 repositories. GitGuardian counted 336 completed runs that exfiltrated 26 secrets from 13 repositories.

The Hacker News's headline says tens of thousands of repositories, citing Socket. That conflicts with the two counts above, and Socket's own post was not fetched, so it is not used as a figure here.

How the accounts were taken

Neither StepSecurity nor GitGuardian has published how the attacker obtained the maintainers' credentials. The Hacker News writes that a leaked personal access token is the most likely route, an inference rather than a finding. No malicious package releases had been published with stolen publishing credentials at that point, and StepSecurity says to hold releases until a repository is clean, since an exposed publishing token lets the attacker publish as the maintainer.

The September 2025 original hit 817 repositories and exfiltrated 3,325 secrets, GitGuardian says. Its verdict on the gap since: "Our data shows that GhostAction never really stopped."

What to check

Search every branch and fork for the two filenames, and review workflow runs since August 31. StepSecurity lists /?c=monami and /?c=new as URL markers and 193.32.204.199 on ports 80 and 3000 as the server. Require approval for workflow runs and protect .github/workflows/* with branch rules.

The order of operations matters as much as the checklist. Collect the run logs before deleting the workflow, because the logs show which secrets left. CISA applies the same logic to federal agencies under BOD 26-04, which asks for forensic triage on 78 of the 122 catalogue entries added since June 10, with deadlines that vary by exposure.