GhostAction 2026: How a GitHub Actions Supply-Chain Campaign Targeted Developer Credentials and Cloud Access
Executive Summary
Between October 8 and 26, 2026, the GhostAction supply-chain campaign injected malicious GitHub Actions workflow files into more than 23,000 public repositories using roughly 1,800 compromised developer accounts, pushing 72,000 commits across two escalating waves. Payloads targeted repository secrets, AWS OIDC tokens, and AI-provider API keys, while a PolinRider-derived 'font stealer' attempted to install a Node.js credential stealer on local developer machines. GitHub's platform controls blocked workflow execution, and GitGuardian found no confirmed successful runs, but stolen tokens from the October 8 wave remained active weeks later, demonstrating persistent unauthorized access across CI/CD and cloud environments.
The incident illustrates how adversaries are weaponizing developer trust in automation pipelines to harvest cloud credentials at scale. With attackers now probing AWS OIDC federation and AI-API keys alongside traditional repository secrets, the attack surface extends well beyond source code into live cloud workloads—making CI/CD hygiene, token lifecycle management, and cloud egress controls a board-level priority.
Why This Matters Now
GhostAction's pivot toward AWS OIDC token abuse and AI-provider API key theft in late October 2026 signals a maturation of supply-chain tactics that directly threatens cloud infrastructure. With 1,382 compromised accounts still carrying valid tokens weeks after initial compromise, organizations face ongoing, low-visibility exposure inside their CI/CD pipelines and cloud environments right now.
Attack Path Analysis
GhostAction attackers compromised developer GitHub accounts to inject malicious workflow files into tens of thousands of repositories, harvesting credentials, API keys, cloud OIDC tokens, and AWS role access at scale. Despite GitHub's platform-level blocking of most workflow executions, attackers retained persistent access via stolen tokens across nearly 1,800 accounts, positioning themselves for future pivots into CI/CD pipelines and cloud environments through credential reuse, OIDC token abuse, and local developer machine infostealers copied from North Korean PolinRider tradecraft.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers compromised developer GitHub accounts—likely through credential stuffing or phishing—then used those accounts to push malicious GitHub Actions workflow files (e.g., security-audit.yml) into approximately 23,000 public repositories across two waves (Oct. 8-12 and Oct. 13-21). The font stealer payload, copied from North Korea's PolinRider campaign, disguised a Node.js credential stealer as a VS Code task to target developer endpoints directly. LLM-assisted variant generation is suspected to explain the rapid iteration of five payload variants.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Valid Accounts
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Private Keys
Scheduled Task/Job: Scheduled Task
Steal Application Access Token
Use Alternate Authentication Material: Application Access Token
User Execution: Malicious File
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Supply Chain Risk Management
Control ID: SA-12 / SR-3
PCI DSS 4.0 – Management of System and Application Accounts
Control ID: Requirement 8.6 / 8.2
CISA Zero Trust Maturity Model 2.0 – Least Privilege and Continuous Validation of Identities and Workloads
Control ID: Identity Pillar — Credential Management / Application & Workload Pillar
NIS2 Directive – Supply Chain Security and Incident Response Obligations
Control ID: Article 21 — Security of Supply Chains / Article 23 — Incident Reporting
DORA (EU 2022/2554) – ICT Risk Management and Third-Party Dependency Controls
Control ID: Article 6 — ICT Risk Management / Article 28 — ICT Third-Party Risk
ISO/IEC 27001:2022 – Secure Development Lifecycle and Cloud Security Controls
Control ID: A.8.29 — Security Testing in Development and Acceptance / A.5.23 — Information Security for Use of Cloud Services
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
GhostAction's supply-chain attack directly compromises developer accounts and CI/CD pipelines, stealing GitHub tokens, API keys, and source-code credentials, threatening egress security and zero-trust segmentation across software build environments.
Information Technology/IT
Persistent compromise of 1,800 developer accounts with valid stolen tokens enables lateral movement into cloud environments, demanding multicloud visibility, east-west traffic controls, and zero-trust segmentation per NIST.800-53 and ZTMM compliance mappings.
Computer/Network Security
GhostAction's infostealer payloads targeting AWS OIDC tokens and self-hosted CI runners expose security vendors' own toolchains, requiring egress policy enforcement and anomaly detection to prevent credential exfiltration across hybrid environments.
Internet
Attackers injecting malicious GitHub Actions workflows across 23,000 public repositories at scale directly threatens open-source infrastructure integrity, demanding cloud-native security fabric controls and inline IPS to block supply-chain credential theft.
Sources
- GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHubhttps://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-githubVerified
- GitGuardian Research: GhostAction Campaign Escalation October 2026https://blog.gitguardian.com/ghostaction-campaign-escalation-october-2026/Verified
- GitHub Actions Security Hardening Guidehttps://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actionsVerified
- CISA Alert: Defending CI/CD Pipelines Against Supply Chain Attackshttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-189aVerified
- OpenSourceMalware Coverage of GhostAction and PolinRider Copycat Activityhttps://opensourcemalware.org/ghostaction-polinrider-copycat-2026
- MITRE ATT&CK T1195.001 - Compromise Software Dependencies and Development Toolshttps://attack.mitre.org/techniques/T1195/001/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the GhostAction campaign relied on lateral movement from CI/CD runner environments into cloud accounts and internal networks using stolen OIDC tokens and GitHub PATs. By enforcing identity-aware segmentation and restricting east-west and egress paths, Aviatrix would likely reduce the blast radius of stolen credentials reaching sensitive cloud workloads and infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Consistent Zero Trust fabric policies across cloud environments would likely reduce the reachability of workloads and cloud resources that compromised CI/CD runner identities could access, constraining how far initial foothold credentials could reach into protected cloud segments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain the cloud account surfaces reachable by assumed IAM roles, reducing the privilege scope available to an attacker who successfully obtained an OIDC-derived AWS credential from a compromised runner environment.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the reachability of internal cloud workloads and network segments from self-hosted runner infrastructure, constraining an attacker's ability to pivot deeper into organizational cloud environments using stolen runner or PAT credentials.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized policy control would likely surface anomalous outbound communication patterns from runner-adjacent cloud workloads, reducing the time to detect unexpected external callout behavior and constraining unmonitored command-and-control paths traversing cloud network boundaries.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement on cloud workload outbound paths would likely constrain unauthorized data flows leaving runner-adjacent cloud environments, reducing the effectiveness of bulk credential exfiltration by limiting outbound connectivity to explicitly permitted destinations.
With segmented cloud access paths and constrained east-west reachability already limiting lateral movement and privilege scope, the residual risk would likely be reduced to credential reuse attempts rather than broad cloud account takeover, limiting attacker-accessible AWS resource surfaces even when valid tokens are held.
Impact at a Glance
Affected Business Functions
- CI/CD Pipeline Integrity and Software Build Processes
- Cloud Infrastructure Access and Identity (AWS IAM, OIDC Token Management)
- Source Code Repository Confidentiality and Secrets Management
- Developer Endpoint Security and Credential Hygiene
Estimated downtime: 3 days
Estimated loss: N/A
The GhostAction campaign targeted and in some cases exfiltrated: GitHub personal access tokens, repository secrets, CI/CD pipeline secrets stored in GitHub Actions, package publishing tokens (e.g., npm, PyPI), AI-provider API keys (e.g., OpenAI, Anthropic), AWS OIDC tokens enabling cloud role assumption, credentials embedded in source code and Git history, and developer machine credentials via the Node.js font-stealer payload mimicking PolinRider. Approximately 1,792 developer accounts were confirmed compromised with active tokens, and 23,000 public repositories were targeted across two waves. While GitHub blocked malicious workflow execution and no confirmed credential harvesting from this specific wave was verified, the persistent access to 1,382 previously compromised accounts represents a significant latent exposure risk. Financial loss is reported as $0 at this time because no confirmed successful exfiltration or downstream breach was validated; however, downstream impact to organizations whose repositories were seeded with malicious workflows or whose developer machines were exposed to the font-stealer could be substantially higher if follow-on intrusions occur.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation and least-privilege identity-based policies to CI/CD pipeline service identities and self-hosted runner environments, restricting which workloads can assume cloud IAM roles via OIDC tokens to prevent privilege escalation from compromised workflows (CNSF: Zero Trust Segmentation, NIST.800-53.AC-6).
- • Deploy Egress Security and Policy Enforcement with FQDN filtering on GitHub Actions runner environments and developer endpoints to block unauthorized outbound connections to attacker-controlled infrastructure during workflow execution, preventing credential exfiltration (CNSF: Egress Security & Policy Enforcement, NIST.CSF.PR.DS-5).
- • Enable Multicloud Visibility and Control to monitor anomalous AWS API activity following OIDC token issuance from CI/CD pipelines—establish baselines for expected role assumption patterns and alert on deviations indicative of stolen token abuse (CNSF: Multicloud Visibility & Control, NIST.800-53.AU-6).
- • Enforce East-West Traffic Security controls between self-hosted runner infrastructure and internal network segments to prevent lateral movement from a compromised runner into internal CI/CD systems, cloud control planes, or developer endpoints (CNSF: East-West Traffic Security, NIST.800-53.SC-7).
- • Leverage the Cloud Native Security Fabric (CNSF) for real-time inline enforcement and distributed policy across cloud-connected developer environments to detect and block LLM-assisted rapid payload variant deployment and supply chain worm propagation patterns at the network fabric layer before they reach internal workloads (CNSF: Cloud Native Security Fabric, NIST.CSF.ID.RA-3).
