GhostAction Reuses Maintainer PATs to Inject Credential Exfil Workflows Across 500+ GitHub Accounts

The campaign began 13:20 UTC 9 October 2026 when Takashi Kitao’s account injected the workflow into 27 repositories; eight hours later Henry Wu’s account pushed the identical file to 318 more in a 16-minute burst. Socket telemetry shows the pattern has now touched over 500 accounts and tens of thousands of repositories since 7 October. The workflow runs on any push, checks out with fetch-depth 0, then greps the working tree and full git history for 13 credential regexes before curling results in cleartext.

StepSecurity and GitGuardian logs reveal the same hard-coded IP and workflow filenames used in the September 2025 GhostAction wave that harvested 3,325 secrets from 817 repositories. The only new element is scale: the operators now target accounts whose repositories exceed 10k stars, increasing the blast radius of any single PAT compromise. No evidence links the activity to a state actor; the infrastructure and tradecraft remain consistent with prior financially motivated supply-chain operations.

Repositories containing the malicious workflow must be treated as fully compromised. Maintainers should revoke all PATs issued before 31 August 2026, rotate every secret that appeared in git history, and delete the workflow from all branches including forks. GitHub has not yet published a timeline for mandatory secret-scanning enforcement on workflow_dispatch triggers.

Next phase indicators include continued use of the same IP and workflow names; any deviation would signal either a new operator or deliberate misdirection.