Science & Tech · Cybersecurity · 3 hrs ago
Malicious GitHub workflow steals credentials from tens of thousands of repositories
Two GitHub accounts added a malicious workflow to hundreds of repositories on October 8, 2026.
The workflow was found in tens of thousands of repositories, including organization-owned projects and an Uber-owned repository.
It was named to look like a security check, but it stole credentials and sent them to an external server.
GitHub Actions are automated tasks that can run when events happen in a repository, so the workflow could operate as part of normal development activity.
Earlier activity in the GhostAction campaign mainly targeted secrets used by automated workflows, while this version also searched files and Git history for credentials that developers may have committed and later deleted.
Those credentials could provide access to cloud infrastructure, hosted applications and AI services.
As of October 9, researchers said the workflow remained on examined repositories' default branches and had run successfully, but they had not found evidence of resulting malicious package releases on PyPI or crates.io.
A malicious GitHub Actions workflow was found in tens of thousands of repositories and was designed to steal credentials.
Security researchers at Socket said the workflow sent stolen credentials to an external server over HTTP.
The workflow was pushed to hundreds of repositories on October 8, 2026, by two GitHub accounts with permission to modify them.
The attack also searches repository files and full Git histories for credentials, expanding beyond secrets stored in GitHub Actions.
As of October 9, the workflow remained on default branches examined by Socket and had successfully run in affected repositories.
- Who
- Two GitHub accounts, henrywoo and kitao, pushed the workflow. Socket researchers uncovered the attack.
- What
- A malicious GitHub Actions workflow steals credentials from repositories and sends them to an external server.
- When
- It was pushed on October 8, 2026. As of October 9, Socket said it remained in repositories it examined.
- Where
- GitHub repositories, including organization-owned repositories and an Uber-owned project.
- Why
- Not stated
This story does not have two clearly opposing sides.
The accounts henrywoo and kitao pushed the malicious workflow to hundreds of repositories.
Socket reported that the workflow remained on default branches it examined and had successfully run in affected repositories.
Infosecurity Magazine published its report on the attack.
- Affected repositories
- Tens of thousands
- Accounts that pushed the workflow
- henrywoo and kitao
- Workflow file
- .github/workflows/security-audit.yml
- External server
- 193.32.204[.]199
- Example affected project
- uber/athenadriver