GhostAction compromised roughly 1,900 GitHub accounts

TL;DR: GhostAction compromised roughly 1,900 GitHub accounts and planted fake security-audit.yml workflows across 30,000+ repositories to drain CI/CD secrets. Your pipeline is the perimeter now. The only secret controls that count are the ones that run in CI, signed and unskippable.

The attackers named their malicious workflow security-audit.yml. Sit with that for a second. In 2026 the most convincing disguise you can give a thief is a security control.

GhostAction escalated hard on 8 and 9 October. Roughly 1,900 compromised GitHub accounts, more than 30,000 repositories touched, 3,000 users and organisations caught in it. Entry was boring: stolen personal access tokens and credentials lifted by infostealers. With write access in hand, the operators committed a workflow file and let GitHub's own runners do the exfiltration for them. An earlier wave went after more than 3,174 secrets sitting in public repos' CI workflows, and the payloads have since grown scanning features for AWS keys, GitHub and GitLab tokens, and AI provider API keys.

Why CI? Because that is where everything valuable now lives. Cloud credentials, deploy keys, registry tokens, and the API keys for every AI service your teams quietly adopted this year. GitGuardian's 2026 numbers put AI-service secrets up 81% year on year, with AI-assisted commits leaking at roughly 3.2% against a 1.5% human baseline. 28.65 million secrets hit public GitHub, up 34%. And 64% of credentials confirmed exploitable back in 2022 were still valid when rechecked. An attacker does not need your production environment when one phished token gets your pipeline to hand over the keys.

The workflow file is production code

A GitHub Actions workflow runs with access most internal services would envy, and most teams merge changes to it faster than a README fix. GhostAction is what that habit costs. Review workflow changes like code. Alert on them. Pin your actions. None of this is novel advice, which makes it worse that a fake security-audit.yml sailed into tens of thousands of repositories.

infostealer creds→stolen PAT→push security-audit.yml→GATE: signed merge→GATE: CI secret scan→runner never exfils

What actually holds

In the pipeline I run, secret detection fires twice, and only one of those runs counts.

• Pre-commit is developer experience. Advisory. Anyone can --no-verify past it, and it executes on a laptop I do not control, in a shell I do not control, at the discretion of someone under deadline pressure. I never describe it as a security boundary.
• The CI scan is the control. GitGuardian in CI is unskippable and blocks merge. No appeal to a human having a bad day.
• The merge gate is one blocking status, not six advisory checks. Six checks train people to read past them, and that inattention generalises to the check that mattered. Consolidation cost some reporting granularity. Correct trade.
• PRs are signed. Ed25519 keys generated on-device, rotated every 90 days with a 7-day overlap. A stolen PAT can push a commit. An unsigned commit does not merge, and there is no override, because an override that exists gets used at 5pm on a Friday. Agent keys are separate and live 30 days, so the audit trail can tell a human merge from a release-agent merge.

Honest cost: the signing rollout was the worst week of the whole project. I would still do it again, because this campaign is the exact threat model it answers.

Provenance is not identity

One caveat before anyone declares attestations the fix. Shai-Hulud published with valid provenance attestations, because the compromised build genuinely ran in the real pipeline. Provenance proves where an artifact came from. It says nothing about whether the author was who you think. Identity at the point of authorship is a separate property, and you want both.

Verdict

The perimeter moved into the pipeline years ago. GhostAction is just the invoice arriving. Put the gate where the attacker operates, which is CI, and stop grading your security posture on hooks that run at someone else's discretion.

Sources: SC Media on the GhostAction escalation · eSecurity Planet weekly roundup