GhostAction Campaign Hijacks GitHub Maintainer Accounts to Steal Cloud Credentials at Scale
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised legitimate GitHub maintainer accounts to inject malicious CI/CD workflows into hundreds of repositories, demonstrating how trusted identities can become the entry point for large-scale supply chain attacks. Beyond stealing GitHub Actions secrets, the campaign scanned full Git histories for cloud and AI service credentials — a critical reminder that secrets committed even briefly to version control history remain a persistent liability. This matters because exposed cloud credentials can grant attackers persistent, wide-ranging access to production infrastructure far beyond the compromised repository itself. Organizations that treat CI/CD pipelines as inherently trusted environments without credential hygiene controls are disproportionately exposed to this class of threat.
Tactical Insight
Immediate actions
- Audit all GitHub maintainer accounts for unauthorized OAuth app authorizations, active sessions, and recent workflow file changes.
- Rotate all secrets stored in GitHub Actions environments, repository settings, and any credentials that may have ever been committed to Git history.
- Scan full repository Git histories using tools like `git-secrets`, `truffleHog`, or `gitleaks` to identify and revoke any exposed credentials.
Long-term improvements
- Enforce phishing-resistant MFA (e.g., hardware security keys) on all accounts with repository write or admin access.
- Store cloud credentials exclusively in dedicated secrets managers (e.g., AWS Secrets Manager, HashiCorp Vault) and inject them into pipelines at runtime rather than storing them as static repository secrets.
- Implement branch protection rules and required code reviews for all changes to workflow files under `.github/workflows/`.
Detection measures
- Configure alerting on unexpected additions or modifications to GitHub Actions workflow files, especially from accounts that do not typically modify CI/CD configuration.
- Monitor outbound network connections from CI/CD runners for traffic to unknown or hardcoded IP addresses.
- Enable GitHub's secret scanning and push protection features to automatically block and alert on credential exposure in commits.