githash docs

A long-running campaign that uses stolen developer credentials to commit a GitHub Actions workflow into the victim's repositories, under the victim's own identity. The workflow (usually .github/workflows/github_actions_security.yml, "Add Github Actions Security workflow") posts the repository's secrets, named one by one from a scrape of its existing workflows, to an attacker endpoint on every push. The first wave, in September 2025, hit about 900 repositories. A second wave from August 31 to September 30, 2026 hit 772 more, often re-editing the workflows left over from 2025 to point at a new endpoint. A September 2026 variant ships as security-check.yml and tags each injection with an id. On October 8, 2026 a security-audit.yml variant hit hundreds more repositories, including uber/athenadriver and kitao/pyxel, and also searched each repository's files and full git history for committed AWS, GitHub, GitLab, AI-provider and Slack keys. The same credentials have been reused for cryptomining.

references

• https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/
• https://socket.dev/blog/ghostaction-cloud-credentials

spread over time

Press play to watch the threat spread, or drag the slider to pick dates.

known-malicious hashes · 1,189