GhostAction Attack Hijacks 500+ GitHub Accounts to Steal API Keys

Open a GitHub repository this week and you might find a workflow file sitting in the pipeline with a name like security-audit.yml — looking, at a glance, like something that's there to protect the code. It isn't. Security researchers at Socket say that file is the calling card of a campaign called GhostAction, and in the space of a few days it has hijacked more than 500 GitHub accounts and planted its fake "audit" script across tens of thousands of repositories.

What the attack actually does

A GitHub Action is a small automated script that runs whenever something happens in a repository — code gets pushed, a pull request opens, that sort of thing. Developers use them to run tests, build software, or scan for bugs automatically. GhostAction's version pretends to be a routine security scan but does the opposite: it checks out the entire commit history of the repo, including everything that was ever deleted or overwritten, and then runs a search through it for anything that looks like a credential.

According to Socket's analysis, the workflow runs a set of regex patterns hunting for AWS access keys, GitHub personal access tokens (the long strings developers use instead of a password for automated logins), and — notably — API keys for Anthropic and OpenAI. Whatever it finds gets sent straight to a hardcoded IP address. The earlier, narrower version of this campaign compromised a couple of hundred repositories tied to a small number of maintainer accounts; the version spotted this month has grown past 500 accounts and spread to tens of thousands of repos since October 7.

A workflow file that claims to audit your security and instead mines your entire git history for secrets is about as close to a wolf in sheep's clothing as CI/CD gets.

Why AI API keys are suddenly a juicy target

It's worth pausing on why Anthropic and OpenAI keys made the hit list alongside the usual cloud credentials. A leaked AWS key gets an attacker server access; a leaked AI API key gets them a paid, often high-limit account that can be resold, used to run abuse campaigns, or simply burned through for free compute at someone else's expense. As more startups wire AI calls directly into their build and deployment pipelines, those keys end up sitting in the same places as cloud secrets always have — and attackers have noticed.

What's still murky is how the attackers got in to begin with. Socket hasn't pinned down the initial access method, though independent researchers at Aviatrix suspect maintainers' personal access tokens were lifted by separate infostealer malware (malicious software built to quietly scrape saved passwords and tokens off an infected machine) and then reused here. Socket says it hasn't yet found poisoned packages published to PyPI or crates.io as a result of this particular wave, which at least limits the blast radius for now.

The India angle

India has one of the largest developer populations on GitHub anywhere in the world, and a huge share of that activity runs through exactly the kind of automated CI/CD pipelines GhostAction is exploiting — from solo open-source maintainers to funded SaaS startups in Bengaluru and Pune shipping multiple times a day. Many of these teams have added AI features over the past year and now store OpenAI or Anthropic keys as GitHub secrets without a second thought. If a campaign like this reaches an Indian company's repository, the exposure isn't just a GitHub problem: leaked cloud keys can mean customer data sitting in a compromised database, which brings India's Digital Personal Data Protection (DPDP) Act's breach-notification obligations into play. It's a good moment for engineering teams here to actually look at what's running in their Actions tabs rather than assuming it's all familiar.

What to actually check

If your organisation uses GitHub Actions, security teams are recommending a short, concrete checklist rather than a vague "stay alert":

• Search your repositories for any workflow file named security-audit.yml that you didn't add yourselves.
• Revoke and rotate GitHub personal access tokens, OAuth app grants, and SSH keys that haven't been reviewed recently.
• Rotate any AWS, OpenAI, or Anthropic API keys that were ever stored as repository secrets, even ones you think are unused.
• Check outbound network logs for any connection to 193.32.204.199, the IP address tied to this campaign.
• Review your Actions run history for jobs you don't recognise, especially ones added in the last two weeks.

None of this requires exotic tooling — it's mostly a matter of actually looking. That's arguably the real lesson here: the attackers didn't need a zero-day exploit or a clever bypass, just a workflow file that looked boring enough not to get a second glance. As CI pipelines quietly accumulate more and more valuable secrets — AI keys included — "boring enough to ignore" is turning into one of the more dangerous properties a file can have.