GhostAction: Tens of thousands of repositories GitHub compromised with malware that steals credentials of cloud and AI

During the weekend of November 7-9, 2026, a new wave of the attack GhostAction was detected.

Tens of thousands of repositories GitHub were infiltrated with workflows malicious.

The goal: to steal credentials from AWS, Azure, OpenAI, and any cloud service or AI developers to have in your code.

If you’re a developer and you’re using GitHub, your repo could be committed. Now.

What happened

The attack

FACT (according to GB Hackers):

A new wave of the attack GhostAction is pushing GitHub Actions workflows malicious repositories.

FACT: The range is tens of thousands of repositories infiltrates.

FACT: The malware is looking for:

• Credentials of cloud (AWS keys, Azure tokens, GCP credentials)
• Credentials IA (OpenAI API keys, Anthropic tokens, etc)
• In the source code
• In the git history complete (commit earlier)

How it works

1. Workflow is malicious pushed to the repository (via engagement of the repo or the account of the owner)
2. The Workflow runs automatically on GitHub Actions
3. You search for files containing credentials (env files, config files, code)
4. Looking at the whole history of your git credentials that were removed but they were in history
5. Exfiltría any key/token/credential found

Why is critical

Vector 1: Credentials of cloud exposed

If your AWS key was stolen, the attacker has access to:

• All your servers
• All your databases
• All of your backups
• Potentially your customer data

Cost of remediation: Thousands to millions of dollars + downtime + gap of privacy.

Vector 2: Credentials IA = access to model + expenses

If your OpenAI API key was stolen, the attacker:

• You can use your API key to run queries in GPT-4
• The expenses fall in to your account
• You can use your quota before you know it
• Access to your information (if you used the API with sensitive data)

Cost: Potentially thousands of dollars in queries is not authorized in minutes.

Vector 3: Supply chain amplification

If an open source developer is committed:

• Your repo is infiltrated
• Workflow malicious run in your CI/CD
• Credentials of the developer stolen
• But also: potentially, the credentials of any service that you use in your development (secrets management, deployment, etc)

A developer committed = potentially hundreds of projects dependent on risk.

The pattern of attack

Step 1: Access to the repository

The attacker gains access via:

• Credentials compromised from the developer
• GitHub account hacked
• Access Token to the personal access token is stolen

Step 2: Inject workflow malicious

In .github/workflows/, the attacker creates or modifies a workflow YAML that:

• Is run on each push/PR (normal)
• Run command to extract credentials
• Exfiltría to a server controlled by the attacker

Step 3: auto-Run

Every time someone pushea code:

• The workflow runs automatically
• Credentials are extracted
• Data are exfiltrados

The developer does not notice anything (workflow seems legitimate).

How to 24Cevent would have helped

If the developers/companies have detection of anomalies in its pipeline CI/CD:

Detection of workflow anomalous

When the malware is injected:

• YAML file: New workflow was added with no change in repo ‘normal’
• Correlation: the Change coincides with remote access anomalous GitHub
• Action: Blocking of merge + research

The malware is never mergeado.

Detection of exfiltration of credentials

When the workflow tries to exfiltration:

• Network: Connection to unknown IP from CI/CD environment
• Data: Volume anomalous data coming out of the CI/CD
• Correlation: Data being exfiltrados to unknown location

24Cevent: ‘CREDENTIAL EXFILTRATION DETECTED’ + lock immediately.

Detection of multiple repositories committed

When GhostAction is sneaking up tens of thousands of repos simultaneously:

• Correlation: the Same pattern of attack in 1000+ repos simultaneously
• Analysis: Supply chain attack in progress
• Escalation: ‘GITHUB-WIDE SUPPLY CHAIN ATTACK DETECTED’

GitHub + developers notified immediately.

The lesson

This attack demonstrates that:

1. The developers are targets of high value (credential = access to everything)
2. CI/CD pipelines are vectors of attack (malicious code is executed automatically)
3. Git history is a risk (credentials removed are still in history)

For developers:

• Use secrets management (not in code)
• Rotate credentials regularly
• Audit git history for credentials
• Monitor CI/CD for changes anomalous

SOURCES CHECKED:

• GB Hackers – GhostAction Supply Chain