The Trojan Horse in Your Repo: Inside the GhostAction Supply Chain Heist

Imagine opening your morning code repository, scrolling past the usual pull requests, and spotting a new commit. It’s labeled helpfully: “Add security audit workflow.”

It sounds responsible. After all, who wouldn’t want a digital guard dog keeping watch over their codebase? But in the world of modern software development, that digital guard dog is sometimes a wolf in sheep’s clothing.

A Wolf Disguised as a Security Audit

The strategy behind GhostAction is as brazen as it is clever. Rather than trying to brute-force corporate firewalls or deploy complicated zero-day exploits, threat actors are going straight for the crown jewels by hijacking trusted maintainer accounts (such as accounts belonging to popular developers like henrywoo and kitao, whose widely used Pyxel project boasts over 18,000 stars).

Once the attackers gain write access to an account, they don’t just mess with a single project. They leverage the maintainer’s elevated permissions to cast a wide net, injecting a malicious YAML file usually named .github/workflows/security-audit.yml or github_actions_security.yml – across every single repository that the account can modify.

To the casual observer or a tired developer reviewing a changelog, the commit looks completely benign. It blends seamlessly into the background hum or routine maintenance.

The Silent Heist

What does this phantom workflow actually do? It plays the long game.

The moment developers push fresh code or trigger a workflow, the malicious script springs into action. Instead of executing complex malware that might trip antivirus alarms, it acts as a digital vacuum cleaner. It scans the repository’s configuration, targets existing GitHub Actions secrets, and deep dives into the historical source code to unearth buried treasures.

We aren’t just talking about generic passwords. The sweep hoovering through these repositories collects:

1. Cloud keys and infrastructure credentials (like AWS access keys and Azure tokens)

2. AI and SaaS API credentials (including OpenAI, Anthropic, and OpenRouter keys)

3. Package publishing tokens (PyPI passwords, npm tokens, and DockerHub credentials)

With a single execution, these credentials are neatly packaged and zipped off via a straightforward HTTP POST request straight to an external, attacker-controlled destination.

Why GhostAction Keeps Coming Back

What makes GhostAction so fascinating and terrifying to security researchers is its persistence. Investigations by firms like Socket and GitGuardian reveal that this isn’t a one-off hit-and-run. The campaign has rolled out in multiple waves, showing an uncanny resilience. In some instances, when security teams thought they had scrubbed their codebases, they discovered that older malicious workflows left behind months prior had simply been quietly updated to point toward new collection endpoints.  

It highlights a dangerous blind spot in the open-source ecosystem: we deeply trust our automation. Developers spend hours optimizing their CI/CD pipelines for speed and efficiency, rarely stopping to audit whether their automated pipelines are turning against them. 

Slamming the Door on the Ghosts 

Securing a modern development pipeline against campaigns like GhostAction requires shifting from a mindset of “blind trust” to “verify everything.” Cybersecurity analysts recommend a few non-negotiable steps for engineering teams: 

1. Rotate Everything: If an account is compromised, changing the account password isn’t enough. Every token, SSH key, cloud credential, and CI/CD secret referenced in past workflows must be systematically revoked and regenerated.  

2. Enforce Least Privilege: Restrict GitHub Action tokens, so they only have access to what they absolutely need, rather than handing out blanket permissions.  

3. Lock Down Workflow Files: Implement strict branch protection rules and mandatory peer reviews for any changes made inside the .github/workflows/ directory. 

The GhostAction campaign serves as a stark reminder that in the interconnected world of software supply chains, your security is only as strong as your weakest integrated tool. If an attacker can trick your automated workflow into turning against you, the call isn’t coming from outside the house, it’s coming straight from your own pipeline. 

https://socket.dev/blog/ghostaction-cloud-credentials

If you’re reading this article, use the discount code CQBLOG_AMSC27_GHOST at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 31, 2026. Take advantage of this exclusive opportunity and secure your spot.