In September 2025, researchers identified a threat campaign that used previously compromised credentials to inject malicious tasks into victims’ CI/CD systems. The campaign, called GhostAction, aimed to steal credentials stored in CI/CD pipeline configurations. Because the Shai-Hulud malware family later reused the same technique, security researchers initially saw GhostAction as a precursor to the more aggressive campaigns that followed.
GhostAction returned in September 2026. This new wave began on August 31, continued through September, and ended with a larger burst in early October. At first, the threat actor repeated the original playbook: a malicious workflow definition extracting secrets from the CI/CD configuration. Only the exfiltration address changed, suggesting the attacker had switched infrastructure.
This first phase targeted 373 GitHub users in an attempt to collect about 2,500 secrets. However, the actual impact was far lower, as GitHub identified and blocked the malicious payload. Our investigations of public repositories found only a few dozen secrets that were successfully compromised.
In early October, the threat actor changed tactics. While the core goal remained the same—compromising credentials—the new malware also scanned victims’ code repositories for secrets, expanding beyond the CI/CD extraction. That shift matters. Scanning repositories for secrets as part of such an attack only makes sense if the attacker expects to reach private repositories, which means:
- The threat actor expects to reach a meaningful number of private repositories.
- They have learned that private repositories are more likely to contain leaked secrets, something GitGuardian has been warning about for years, and are now taking advantage of it.
The revised payload also ran without GitHub blocking it at first, greatly increasing the blast radius compared to the first phase. During this phase, the threat actor targeted 30,000 repositories across 3,000 users and organizations. It took GitHub a few days to identify and block the payload, giving most of the 3,100 targeted CI secrets time to be exfiltrated. The victim list includes well-known organizations and projects, including Uber.
The victim list revealed another troubling pattern. From our observations, some accounts targeted during the 2025 attack campaign were hit again in 2026. Similarly, the threat actor updated payloads deployed during the September 2026 burst a month after the original incident. That points to a gap in incident remediation. Despite alerts and news coverage, some compromised credentials used as an initial access vector were not properly revoked or rotated, allowing new compromises months later. Closing out a credential-related incident requires making sure the compromised access is actually removed, a difficult task when organizations lack visibility across their credential layer. Similar revocation failures have appeared in other incidents. One of the most prominent was Aqua Security’s Trivy compromise in early 2026, suggesting this is a systemic problem rather than an isolated failure.
Another lesson is where threat actors get leaked credentials and how widely those credentials can circulate. During this wave, we observed the same victims being exploited across a variety of unrelated attack campaigns, especially crypto-mining, using unrelated infrastructure. That pattern suggests multiple threat actors rely on a common set of compromised credentials, either bought on the black market or freely shared among closed communities. Those credentials may come from separate infostealer campaigns, phishing, or other harvesting techniques, often carried out by a different attacker. The result is compounding damage: one leaked credential can fuel multiple attacks, each adding its own financial and remediation costs.
GhostAction shows why credential security requires detection, remediation, and prevention working together. Organizations need to detect leaked credentials wherever they appear, fully remediate compromised access so attackers can’t reuse it, and prevent new exposures before they create another path into the organization.
________
About Gaetan Ferry,
As a security researcher at GitGuardian, Gaetan is pioneering innovations in secret detection. He uses his offensive security and Red Team background to improve our approach to cybersecurity.
Join our LinkedIn group Information Security Community!
