Spooky season came early for open source. A supply-chain campaign called GhostAction is slipping fake "security" workflows into GitHub repositories, which is a bit like a burglar breaking in wearing a hi-vis vest that says "Locksmith." The workflow looks helpful. What it actually does is pack up your secrets and mail them to a stranger.

500 Accounts, One Very Greedy Workflow

According to The Hacker News, researchers at StepSecurity, Socket, and GitGuardian are tracking a big escalation of GhostAction, a campaign first seen in September 2025. Socket says it has found more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since October 7, 2026. Among them are accounts belonging to well-known maintainers, including the author of the pyxel game engine.

The playbook is depressingly simple. The attackers get hold of maintainer credentials (probably leaked personal access tokens), look through a repo's workflows to see which secrets exist, then commit a file with a reassuring name like "security-audit.yml" or "github_actions_security.yml." The payload grabs named GitHub Actions secrets plus anything matching 13 credential patterns: AWS keys, Anthropic, OpenAI and OpenRouter API keys, Docker Hub and database credentials, SSH keys, and more. It sends all of it to an attacker-controlled server over plain, unencrypted HTTP, because apparently this thief can't be bothered with TLS.

Your Pipeline Holds the Master Keys

CI/CD is where the crown jewels live. Your pipeline can reach your cloud, your registries, your databases and your increasingly expensive AI API accounts. Steal one token from it and you can pivot into everything it connects to, which turns a single leaked PAT into a full-blown incident. And because AI API keys are now on the shopping list, a breach can also show up as a very confusing invoice.

The part most people miss is that nobody exploited a fancy zero-day here. It ran on stolen credentials and on the fact that most of us don't look closely at a new YAML file with "security" in the name. The recommended cleanup: audit your repos for these workflows going back to August 31, 2026, revoke the compromised GitHub credentials, rotate every secret, delete the malicious workflows from all branches, and check your forks too.

Long story short, the scariest ghost this October is a commit you never wrote.

If GhostAction has you wondering what's really running in your own pipelines, our free developer's security checklist for defending against supply-chain attacks is a good place to start hunting.

Source: The Hacker News