The recent wave of attacks associated with GhostAction has largely been unsuccessful, yet the operators behind this supply chain campaign appear well-positioned to generate further disruption. This ongoing campaign involves attackers targeting GitHub by compromising developer accounts and injecting GitHub Actions workflow files into repositories. These workflows instruct GitHub Actions on which code to execute when specific events occur, such as a pull request being opened or a commit being pushed. Malicious workflows exploit GitHub's inherent trust in these files, enabling the theft of repository secrets, package publishing tokens, GitHub personal access tokens, credentials embedded within source code, and other sensitive materials. The strategic objective is to use an initial breach to facilitate subsequent compromises and gain access across repositories, CI/CD systems, and cloud environments, echoing patterns seen in recent wild supply chain worms, though the mechanism of operation differs.
The campaign was initially documented in the prior year, and attackers continue to deploy GhostAction against various organizations. A notable change has been an apparent escalation in the technique, which began this month. During an earlier incident spanning October 8 through October 12, the attackers distributed credential-stealing code at scale by pushing the security-audit.yml workflow into approximately 30,000 repositories, utilizing compromised accounts. However, research published by GitGuardian on October 27 pointed to a further escalation. Gaetan Ferry of GitGuardian reported that between October 13 and October 21, the GhostAction operator "pushed 72,000 commits to 23,000 public repositories," noting that 8,000 of these represented new targets.
In this most recent phase of the operation, GitGuardian observed that after a developer account is compromised, the operator deploys distinct payloads contingent upon the runner environment where the repositories reside. Runners are the infrastructure responsible for executing GitHub Actions workflows. While many organizations utilize GitHub-hosted runners, others opt for self-hosted runners operating within their own infrastructure. Among the payloads observed are "seven workflows," which scan GitHub runner repositories and wikis for API keys belonging to AI providers; the "Security-audit.yml" file, seen in earlier GhostAction attacks, which searches Git history and GitHub-hosted source code for credentials; payloads designed for self-hosted CI runners; a payload targeting GitHub runners that requests GitHub OIDC tokens to assume AWS roles and achieve cloud account access; and the font stealer payload, which is the most prominent workflow payload in recent intrusions due to its origin.
The font stealer variant installs a Node.js credential stealer onto local developer workstations, camouflaged as a VS Code task. This methodology appears to be derived from PolinRider, a campaign known for embedding obfuscated loaders within developer repositories to steal credentials and which has been linked to North Korea. Furthermore, the threat actor inserted PolinRider loaders into repositories that had already been affected by GhostAction between October 22 and October 26. Ferry mentioned that of the five distinct payloads, only the PolinRider-styled local stealer had a possibility of successful execution, although GitGuardian possesses no proof that any execution actually took place. Although GitGuardian could not determine if there was any overlap between GhostAction and PolinRider, the organization hypothesized that the GhostAction operator might have copied a public PolinRider launcher to target a shared set of victims.
Jenn Gile, cofounder of OpenSourceMalware, who previously covered the GhostAction attacks this month and detected signs of the PolinRider imitation several weeks prior, informed Dark Reading that the PolinRider copy is indicative of the GhostAction group's internal processes. She stated via email, "What we're seeing looks like imitation, not evolution. The fake-font technique in GhostAction is a copy of what DPRK's PolinRider campaign has been using nearly all of 2026." She further elaborated, "The multiple payloads are real, but they're variations on a theme (five workflow versions over about ten days in one repo we examined), not a new capability. Historically, we might have called this evolution because it took real skill to figure out. But this looks a lot like a LLM helping the threat actor test different variants."
Despite these observations, GitGuardian noted that GitHub successfully identified and prevented the execution of the malicious workflows. Nevertheless, critically, the attackers managed to maintain persistent access to nearly 1,800 compromised accounts, many of which were already utilized in prior GhostAction activity; Ferry reported that "1,382 of the 1,792 compromised accounts had already been used on Oct. 8, so the same stolen tokens keep working." Ferry communicated to Dark Reading that the campaign has been "highly ineffective on the malicious workflows side." However, even without evidence of success in this latest wave, the nature of the payloads—such as the one designed to achieve cloud access—reveals the attackers' likely next objective: pivoting toward internal networks where fewer platform-level defenses might impede their efforts. He explained, "We expect new waves to appear in the near future, with revised payloads. This 'fail early and adapt fast' strategy has already been observed for this threat actor."
Given that targeted accounts or repositories remain compromised, repository owners are advised to search for and eliminate the files listed in GitGuardian's IoC section on the blog across every branch. Moreover, if any indication of compromise surfaces, users must revoke the account's tokens entirely and rotate every credential recorded in the affected repository or its history, alongside every Actions secret and wiki credential.
The tendency for threat actors to iterate rapidly on existing techniques, as seen in the variation of payloads, suggests an operational methodology leveraging advanced tooling to test attack vectors against infrastructure boundaries. This mirrors the broader trend where sophisticated actors adapt quickly to platform defenses, seeking vulnerabilities in less guarded internal environments.
Why it matters
The shift toward targeting developer endpoints and cloud access signals the threat actor's next likely pivot point. Operators must recognize that even failed workflow attacks leave behind persistent compromised credentials. This indicates a sustained, adaptive threat targeting internal infrastructure.
