# New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Compromised maintainer accounts pushed a malicious GitHub Actions workflow to 346 repos, exfiltrating Actions secrets plus cloud/AI credentials swept from working tree and full git history to a hardcoded C2 IP.

- Payout: Real-world hack
- Severity: high
- Program: GitHub
- Credited: Socket Research Team
- Disclosed: 2026-10-09
- Write-up quality: 7/10
- Original: https://socket.dev/blog/ghostaction-cloud-credentials
- Library page: https://bugbountylibrary.com/r/blog%3Asocket-dev-blog-ghostaction-cloud-credentials
- Tags: domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:aws tech:github-actions technique:recon technique:source-review vuln:secrets-leak

**Target:** GitHub Actions workflow / repository secrets and git history
**Root cause:** Stolen maintainer credentials allowed direct commits of a plausibly named workflow to default branches; the workflow runs on any push and exfiltrates secrets via curl to a hardcoded IP.
**Steps:**
1. Compromise maintainer account (henrywoo, kitao) with write access to target repos.
2. Scan existing workflows for Actions secret names and render them into the payload template.
3. Commit `.github/workflows/security-audit.yml` to default branch with `on: push` (no filter) and `workflow_dispatch`.
4. Job uses `actions/checkout@v4` with `fetch-depth: 0` to fetch all branches/tags.
5. Run `grep -rEiho` over 13 credential patterns in working tree and `git log -p --all` for history.
6. Capture `-B2 -A2` context around `AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}` to reconstruct full AWS key pairs.
7. POST concatenated secrets to `hxxp://193.32.204[.]199/?c=monami` via `curl --data-binary`.
8. Use stolen PyPI/crates.io tokens to publish malicious releases; use AWS/AI keys for further access.
**How found:** Socket observed a burst of identical single-file commits adding security-audit.yml across 346 repos in two short time windows, flagged by AI scanner; byte-identical payloads apart from rendered secret names indicated tool-driven automation.
**Exploitation:** Attacker with stolen maintainer PAT commits the workflow; next push triggers it on ubuntu-latest runner, which checks out full history, greps for Actions secrets and 13 credential regexes, and exfiltrates everything in one POST to the C2. Publishing tokens enable supply-chain release hijack; AWS key pairs enable cloud account access.
**Escalation:** Blast radius extends to every repo the compromised account can write, including org-owned repos (uber/athenadriver) and 279 forks; publishing credentials enable downstream supply-chain compromise.
**Insight:** A workflow that runs on any push with `fetch-depth: 0` can read credentials that were committed and later removed but remain reachable from stale branches/tags; context windows around AKIA/ASIA IDs reconstruct usable key pairs, so history scanning must include unreachable objects.