GhostAction is back in GitHub. Last month 86% of its runs never executed.

01 What security-audit.yml actually does

The file calls itself a security audit. Socket’s researchers put it plainly: the workflow has no security function. It runs on every push to any branch, or on demand. It collects two classes of secret and sends both in one POST to 193.32.204.199.

Two details make this wave worse than the last. The AWS patterns capture two lines either side of each key ID, so the attacker gets complete, usable key pairs and not orphaned identifiers. And the history sweep turns every old commit into a liability. A developer who pasted an OpenAI key into a config file in 2023, then deleted it in the next commit, left it in scope for this workflow today.

Socket has not seen how the attackers got the maintainer logins. GitGuardian notes that the commits use the victim’s own identity, which points to stolen credentials. As of 9 October Socket had observed no malicious package versions on PyPI or crates.io from this wave, and the workflow file was still sitting on the default branch of the repositories it checked.

02 Why 3,170 runs never executed

GitGuardian’s count of the late-summer wave is the most useful dataset in this story, because it shows what defence worked. GhostAction is a continuation of the 2025 campaign that hit 817 repositories across 327 users and took at least 3,325 secrets. GitGuardian’s researchers say calling the new wave a revival would be inaccurate. It never stopped.

GitHub held most of those runs for approval [ GitGuardian 2026 ] . A repository can require a maintainer to approve workflow runs triggered by outside collaborators and first-time contributors before they touch a runner [ GitHub Docs ] . Where that gate was on, the theft waited in a queue for a human, and nobody approved it.

This matches what we see in pipeline reviews. The finding that does the damage is rarely an exotic flaw in a workflow. It is a personal access token with write access to every repository its owner ever touched, including the project they wrote for a previous employer and the fork they forgot about. uber/athenadriver is that finding in public: an organisation repository reached through one individual’s account, years after they wrote it.

03 Rotation is two jobs, not one

Most incident runbooks say one thing after a CI compromise: rotate the secrets. Socket’s write-up is blunt about why that fails here. Rotating Actions secrets does nothing for a committed-credential exposure, and scanning the working tree does nothing for an Actions-secret exposure [ Socket 2026 ] . They are separate leaks with separate fixes, and the October workflow takes both.

• The secrets the workflow named. Rotate every one. Revoke personal access tokens outright, since a rotated token with the same scope is the same risk. Treat any completed run as a confirmed theft. Then check your package registries for releases you did not build.
• The keys in your history. Scan with git log -p --all, including unreachable objects, and rotate every credential it finds across all 13 categories. For AWS keys, read CloudTrail for the exposure window and after it: new IAM users, new access keys, regions you never use.
• The login that pushed the file. Revoke the maintainer’s sessions, tokens, OAuth grants and SSH keys, and re-enrol them on phishing-resistant MFA. GitGuardian makes the point that rotating secrets alone leaves the stolen GitHub credential in the attacker’s hands, ready for the next wave.

Forks deserve their own line. The 279 forks under one account each carry the workflow. A fork owner who enables Actions, or syncs with the upstream, runs the theft in their own context against their own secrets. Socket calls private forks and mirrors the most exposed, because nobody outside sees them.

04 Six checks for this week

None of this needs a new tool. An engineering lead with organisation admin rights can finish the list below in a working week, and each item closes a path GhostAction has already used. GitHub’s own hardening guide covers the mechanics of each setting [ GitHub Docs ] .

GhostAction has run since September 2025. It took 3,325 secrets in its first wave, 26 in its second, where the approval queue held most runs back, and an unknown number since 7 October from accounts that push straight to the default branch. Your exposure depends on which of those three groups your repositories sit in. We can tell you that in 14 days. You get every path from a developer login to a production secret in your GitHub organisation, ranked by what it unlocks, and the setting or revocation that closes each one. Start with your Threat Map, from $5,000. Enterprise-grade. Not enterprise-priced.