GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

The GhostAction campaign has resurged with a new wave of malicious GitHub Actions workflows injected into compromised open-source repositories. Attackers compromised maintainer accounts (kitao, henrywoo) to push malicious 'security audit' workflows directly to default branches, bypassing review. These workflows exfiltrate GitHub Actions secrets and mine the entire git history for credentials, including AWS, AI provider, and SaaS tokens. The exfiltration endpoint has shifted to the IP address 193.32.204.199, using plain HTTP to evade domain-based detection. Successful exfiltration was confirmed in multiple repositories, including Uber's athenadriver.

AI-extracted · verify before operational use