GajShield Threat Advisory — GhostAction GitHub Actions Secrets Theft

Severity: High | Priority: 1

GhostAction is a supply-chain campaign that uses stolen GitHub credentials to push malicious workflows into repositories. The workflows send the repository’s CI/CD secrets to attacker servers. Common workflow names are “Github Actions Security” (github_actions_security.yml), “Security Check” (security-check.yml) and “Security Audit” (security-audit.yml).

Between October 8 and 12, 2026, the campaign targeted more than 30,000 repositories by compromising about 1,900 GitHub accounts. Newer versions also scan the repository files and the full git history for cloud keys and tokens. The secrets most often targeted are:

• SSH keys and deployment server credentials
• Azure, AWS and Google Cloud credentials
• container registry and database credentials
• GitHub, npm and PyPI tokens

If an alert is raised for outbound traffic from a machine on your network, it is most likely a self-hosted GitHub Actions runner or a developer machine running workflows locally. Treat every secret available to that repository’s workflows as stolen. Then:

1. Find the injected workflow file and the commit that added it, and remove it.
2. Rotate every secret the workflow referenced, starting with SSH keys, cloud keys and registry tokens. Then review the cloud, registry and server logs for those credentials for use you don’t recognise.
3. Revoke the GitHub credential that pushed the commit, such as a personal access token or session. Rotating the stolen secrets is not enough: the same GitHub account can be reused by other attackers, and GitGuardian found victim repositories later abused for cryptomining. Check the developer’s machine for infostealer malware, and look for unexpected commits, workflows or Docker image changes in other repositories that account can write to.

If an alert is raised for inbound traffic from these addresses, the attacker may be using credentials already stolen from your pipelines, such as a server’s SSH key. Block the source address and review authentication logs on the targeted server. Rotate its keys and passwords, and check it for new user accounts, authorised keys, scheduled tasks and unknown processes.

An alert for carte-avantage.com may involve a legitimate website that was compromised. Investigate the requesting machine as above, but do not assume every visit to that site is malicious.