GhostAction returns with wider secret theft

A workflow file with an innocuous name slipped into tens of thousands of GitHub repositories, and by the time anyone looked, it had already run. Security researchers at Socket have tied the activity to a malicious GitHub Actions workflow that steals credentials and ships them to an external server, according to a report the firm published following its investigation. The campaign reached organization-owned code, including a project at Uber.

The mechanics echo a familiar script. What changed, per Socket, is how much the attackers can now take.

Two accounts, one routine commit

On October 8, 2026, two GitHub accounts — 'henrywoo' and 'kitao' — pushed a malicious GitHub Actions workflow to hundreds of repositories they had permission to modify. A GitHub Action is an automated task that runs inside a repository to handle work such as testing code, building software or deploying applications whenever specific events occur. That makes it a natural foothold: it executes as part of normal project plumbing.

The file was named “.github/workflows/security-audit.yml” and arrived through a single-file commit written to look mundane, with messages reading “Add security audit workflow” and “Update security audit workflow.”

Despite the name, the workflow performs no security checks. According to Socket, it harvests credentials from affected repositories and transmits them over HTTP to an external server at 193.32.204[.]199. Because it resembles a legitimate security tool, it can sit unnoticed while running alongside the repository's automated processes.

The repositories in the blast radius

Socket researchers said the malicious file turned up in tens of thousands of repositories, including ones where 'henrywoo' or 'kitao' held write access. The infection spread through projects tied to those accounts. Among the repositories identified are henrywoo/pyllama and henrywoo/chatllama, AI GitHub projects created by 'henrywoo'. Also listed is kitao/pixel, typically distributed through both the Python Package Index (PyPI) and crates.io — registries where developers publish and distribute software written in Python and Rust, respectively.

Then there is uber/athenadriver, an Uber-owned project where 'henrywoo' has write access as its original author. Uber is named in the report as one of the businesses running compromised packages.

The researchers found the workflow in repositories that had been inactive for a decade, which they said suggests the attackers systematically enumerated every repository they could reach rather than selecting targets by activity or value. The pattern points to automation, not manual targeting.

A quiet design that evades review

Supply chain attacks built on GitHub Actions have a useful property for an intruder: the payload lives in configuration that developers treat as housekeeping. A file called security-audit.yml does not read like an intrusion artifact. It reads like something a colleague added during a hardening pass.

The single-file commit sharpens that effect. Reviewers scanning a large change set for oddities may not stop at one small, plausibly named workflow addition — particularly when the commit message describes exactly the kind of chore that appears in repository histories all the time. Socket characterized the workflow as designed to look like a legitimate security tool so it can go unnoticed while running as part of the repository's automated processes.

Once triggered, the workflow's job is straightforward: collect credentials and send them out over HTTP. That protocol choice means the data leaves without transport encryption, though the significance for defenders is less about interception than about where the information goes.

Beyond Actions secrets, into Git history

The incident is a new variation of the GhostAction campaign, which GitGuardian discovered in September 2025 and which reappeared in October 2026. Earlier GhostAction attacks primarily targeted secrets stored in GitHub Actions, such as API keys and access tokens configured for automated workflows.

The latest version broadens the sweep. According to Socket, it also searches the repository's files and its complete Git history for credentials using regular-expression patterns. That means it can surface sensitive information developers accidentally committed to source code, configuration files or earlier versions of files — even when those credentials were later deleted from the current version of the repository.

Deleted secrets are a particular hazard because deletion does not erase history. A key committed and then removed remains recoverable from earlier commits, and the new variant is built to find exactly that material. The search also targets credentials for cloud providers and AI services, which could expose access to infrastructure, hosted applications and third-party services.

Still present, and already executed

As of October 9, 2026, Socket reported that the malicious workflow was still present on the default branches of the repositories it examined, including uber/athenadriver and kitao/pyxel. The workflow had also successfully executed in affected repositories, meaning the credential-stealing activity was not limited to an attempted injection.

That distinction matters for anyone assessing exposure. A dormant malicious file is a cleanup problem. An executed one is a credential-compromise problem, and the relevant question shifts from removal to rotation.

Socket said it had not observed any malicious package versions published to PyPI or crates.io as a result of the campaign at the time its report was published. The researchers were careful about what that absence does and does not establish: it does not mean the stolen credentials have not been used for other purposes, only that Socket had not identified evidence of follow-on malicious package releases on those two registries.

What the numbers show

• October 8, 2026 — date the two accounts pushed the malicious workflow to repositories they could modify
• Tens of thousands — repositories where Socket researchers found the malicious file, including organization-owned ones
• Two accounts — 'henrywoo' and 'kitao' — behind the push to hundreds of repositories
• 193.32.204[.]199 — external server receiving stolen credentials over HTTP
• October 9, 2026 — date Socket reported the workflow still present on default branches, including uber/athenadriver and kitao/pyxel
• September 2025 — when GitGuardian discovered the original GhostAction campaign
• A decade — age of some inactive repositories that were still affected

Why it matters

For maintainers, the practical consequence is that a repository can be compromised without anyone touching its application code. The workflow sits in .github/workflows, runs with the permissions granted to it, and looks like maintenance. Teams that assume their source is clean because the last commit to their actual code was reviewed may be looking in the wrong place.

The expanded scope of this variant also changes the remediation math. If the workflow read Git history, then rotating only the secrets currently configured in Actions could leave exposed anything that was committed, deleted and forgotten. A credential that was scrubbed from the latest revision is still a credential the attackers may now hold, which suggests affected organizations should treat every secret that ever passed through an affected repository as suspect — including keys for cloud providers and AI services that Socket says the search targeted.

The absence of observed malicious packages on PyPI or crates.io is a narrow finding, and Socket framed it narrowly. It describes what the researchers had seen on two registries as of publication, not a guarantee that stolen credentials are idle. Given that the workflow executed in affected repositories, the safer reading is that credentials left the building and their later use is an open question.

There is also the enumeration detail. Attackers reaching repositories that had been dormant for a decade indicates a sweep that did not bother to sort targets by value. For defenders, that removes the comfort of assuming an overlooked or low-traffic project is beneath notice. If an account has write access, the repository is in scope.

Socket's report places this as an evolution of GhostAction rather than an isolated incident — a campaign that reappeared in October 2026 with broader collection capabilities than the version GitGuardian documented in September 2025. Organizations running GitHub Actions should check default branches for unexpected workflow files, review what those workflows were permitted to read, and treat any credential that touched an affected repository's files or history as compromised until proven otherwise.