Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

The GhostAction campaign demonstrates a sophisticated supply chain attack where compromised maintainer accounts were leveraged to inject malicious CI/CD workflows into thousands of open-source repositories. By abusing trusted GitHub Actions pipelines, attackers silently exfiltrated API keys, tokens, and other secrets to attacker-controlled infrastructure — a technique that is especially dangerous because workflows are often treated as trusted automation. This matters because developers and downstream users of these repositories may unknowingly execute malicious code, cascading the breach across entire ecosystems. The use of leaked credentials as the initial access vector highlights that a single compromised account in a position of trust can have outsized consequences across thousands of projects.