The **GhostAction attack** compromised **327 GitHub accounts**, leading to the theft of **3,325 secrets**, including **PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys**. The attack began with the hijacking of the **FastUUID project**, where the maintainer’s account was breached to inject a malicious **GitHub Actions workflow** named *‘Add Github Actions Security workflow’*—designed to exfiltrate sensitive credentials. GitGuardian detected the campaign, reported it to GitHub, and disrupted the operation by rendering the exfiltration server unresponsive. While **100 of 817 affected repositories** reverted malicious changes, **573 repositories** were alerted via issue notifications (others were deleted or had issues disabled). The attack exposed **API keys, access tokens, and deployment secrets**, risking downstream supply-chain compromises. A separate but unrelated **NPM-based *s1ngularity* attack** hit **2,000 accounts** concurrently, though no overlap was found between victims.
TPRM report: https://www.rankiteo.com/company/github
"id": "git0132201090925",
"linkid": "github",
"type": "Cyber Attack",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '327 compromised accounts (817 '
'repositories)',
'industry': 'technology',
'location': 'global',
'name': 'GitHub',
'type': 'code hosting platform'},
{'industry': 'software development',
'name': 'FastUUID (compromised project)',
'type': 'open-source project'}],
'attack_vector': ['compromised maintainer account',
"malicious GitHub Actions workflow ('Add Github Actions "
"Security workflow')"],
'customer_advisories': ['GitHub issued guidance on securing Actions '
'workflows'],
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['secrets embedded in code/repositories',
'environment variables'],
'number_of_records_exposed': 3325,
'sensitivity_of_data': 'high (authentication credentials, '
'cloud access keys)',
'type_of_data_compromised': ['API keys (PyPI, npm, DockerHub, '
'GitHub, Cloudflare, AWS)',
'GitHub tokens',
'repository secrets']},
'description': "A supply-chain attack dubbed 'GhostAction' targeted GitHub, "
'stealing 3,325 secrets (e.g., PyPI, AWS keys, GitHub tokens) '
'from 327 compromised accounts. The attack was discovered by '
'GitGuardian, who alerted GitHub and disrupted the campaign by '
'shutting down the exfiltration server. A separate but '
"unrelated NPM attack ('s1ngularity') compromised 2,000 "
'accounts around the same time.',
'impact': {'brand_reputation_impact': ['potential trust erosion in '
'open-source projects'],
'data_compromised': ['secrets',
'API keys',
'tokens',
'credentials'],
'identity_theft_risk': ['high (due to stolen secrets)'],
'operational_impact': ['malicious workflow execution',
'repository compromise',
'exfiltration server disruption'],
'systems_affected': ['GitHub repositories', 'CI/CD pipelines']},
'initial_access_broker': {'backdoors_established': ['malicious GitHub Actions '
'workflow'],
'entry_point': 'compromised maintainer account '
'(FastUUID project)',
'high_value_targets': ['GitHub tokens',
'cloud provider '
'credentials']},
'investigation_status': 'completed (attack disrupted, affected parties '
'notified)',
'lessons_learned': ['Open-source maintainer accounts are high-value targets '
'for supply-chain attacks.',
'Malicious CI/CD workflows can bypass traditional '
'security controls.',
'Proactive monitoring of public repositories can disrupt '
'attacks early.',
'Automated secret detection tools (e.g., GitGuardian) are '
'critical for mitigating credential leaks.'],
'motivation': ['credential harvesting',
'supply-chain compromise',
'potential follow-on attacks'],
'post_incident_analysis': {'corrective_actions': ['GitHub enhanced workflow '
'security controls.',
'GitGuardian expanded '
'monitoring for similar '
'attacks.',
'Affected projects rotated '
'compromised credentials.'],
'root_causes': ['Weak authentication for '
'maintainer accounts (lack of '
'MFA).',
'Insufficient validation of GitHub '
'Actions workflows.',
'Exposed secrets in repositories '
'(lack of secret scanning).']},
'recommendations': ['Enforce multi-factor authentication (MFA) for maintainer '
'accounts.',
'Scan repositories for exposed secrets using tools like '
'GitGuardian or TruffleHog.',
'Restrict workflow permissions in GitHub Actions to least '
'privilege.',
'Monitor for unusual CI/CD pipeline modifications.',
'Educate developers on secure secret management (e.g., '
'use of vaults).'],
'references': [{'source': 'GitGuardian Report'},
{'source': 'BleepingComputer',
'url': 'https://www.bleepingcomputer.com'},
{'source': 'TechRadar Pro'}],
'response': {'communication_strategy': ['public report by GitGuardian',
'direct notifications to repository '
'owners'],
'containment_measures': ['shut down exfiltration server',
'reverted malicious commits',
'read-only mode for compromised '
'project'],
'incident_response_plan_activated': True,
'recovery_measures': ['account recovery for legitimate owners'],
'remediation_measures': ['alerted affected users via GitHub '
'issues',
'removed malicious workflows'],
'third_party_assistance': ['GitGuardian (detection/alerting)',
'PyPI (mitigation)']},
'stakeholder_advisories': ['GitHub repository owners',
'open-source project maintainers'],
'title': 'GhostAction Supply-Chain Attack on GitHub',
'type': ['supply-chain attack',
'credential theft',
'malicious workflow injection'],
'vulnerability_exploited': ['account takeover (ATO)',
'malicious CI/CD pipeline injection']}