Malicious GitHub Actions workflows spread through compromised accounts

Researchers said an ongoing credential-theft campaign had used compromised maintainer accounts to add a malicious GitHub Actions workflow to repositories. StepSecurity said Takashi Kitao's account was used first, then Henry Wu's account eight hours later.

StepSecurity said Kitao's account pushed the workflow to 27 repositories, while Wu's account pushed the same file to 318 repositories in a 16-minute window. Socket said it had identified more than 500 GitHub accounts that had committed the workflow to tens of thousands of repositories since 7 October 2026.

The workflow was called Security Audit or GitHub Actions Security, and it sent data to 193.32.204[.]199 over plain HTTP. The collected material could include named GitHub Actions secrets, credentials in the working tree and credentials preserved in the full git history.

GitGuardian said GhostAction had earlier reached 772 public repositories across 373 GitHub users and organisations between 31 August and 30 September 2026. In one case on 30 August 2026, attackers modified kuafuai/DevOpsGPT to place an XMRig miner in the project's Docker image.

Researchers advised checking repositories for either workflow since 31 August 2026, revoking affected credentials, removing the workflow from all branches and reviewing forks. Socket said private forks and downstream mirrors were especially exposed because enabled Actions could trigger further harvesting.