GhostAction campaign steals thousands of CI secrets via fake GitHub workflows

Since October 7, a campaign called GhostAction has been injecting fake security audit workflows into repositories via compromised maintainer accounts. The attack has impacted over 772 repositories according to GitGuardian, with StepSecurity reporting over 3,000 secrets stolen. The malicious workflows harvest credentials by accessing git history and exfiltrating them via plain HTTP to a single IP address. The campaign exploits existing automation trust rather than a GitHub zero-day vulnerability. Security researchers recommend auditing workflow files, reviewing run histories, rotating all potentially exposed secrets, and scanning full git history.