Skip to content

Response, New York. Noah Park: Check Point Patches Actively Exploited Management Server Path Traversal. Detection, Dallas. Ava Okello: Report Finds Nearly Half of Deployed Detections Need Attention Before SOCs Can Trust Them.

SOCtember

Always First. Fast SOC News.

Socket dashboard for uber/athenadriver showing supply chain score zero and known malware alert.
Figure: Socket, uber/athenadriver dashboard with Supply Chain Security score 0 and known malware alert after GhostAction injection, Oct 9, 2026 (fair use).

Threat Intel

Socket Tracks GhostAction Wave Mining GitHub Secrets and Full Git History for Cloud Credentials

Socket research finds compromised maintainer accounts injecting security-audit.yml into hundreds of repositories, expanding GhostAction from Actions secrets to cloud and AI credentials buried in git history.

Priya Shah, Threat IntelSingapore5 min read

SINGAPORE - Socket's research team reports that on Oct. 8, 2026 two compromised GitHub maintainer accounts pushed a single-file workflow named security-audit.yml into every repository they could write to, expanding the long-running GhostAction campaign beyond named GitHub Actions secrets to cloud and AI credentials sitting in source trees and full git history. The accounts, henrywoo and kitao, used commit messages that read like routine hardening. Socket counted the file in 346 repositories in that burst: 318 under henrywoo (39 source repositories and 279 forks), 27 under kitao, and uber/athenadriver, an Uber-owned repository henrywoo can still write to as its original author. The henrywoo sweep ran between 21:10:15Z and 21:26:32Z; the kitao window was about four minutes at 13:40 to 13:44Z. In an Oct. 9 update, Socket said it had identified more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since Oct. 7, including organization-owned projects reached through compromised contributors. Exfiltration goes in cleartext over plain HTTP to the hardcoded address 193.32.204.199.

Dot chart of GhostAction malicious workflow commits by hour on October 7 and 8, 2026.
Figure: Socket Threat Research, GhostAction malicious workflow commits per hour October 7-8, 2026 (fair use).The Oct. 7 to Oct. 8 commits clustered in short bursts across hundreds of accounts.

The workflow has no security function. It triggers on any push and on workflow_dispatch, checks out with fetch-depth set to 0 so every branch and tag is present, then runs an Audit step that still steals named Actions secrets when reconnaissance found them and adds a new sweep. Thirteen regex patterns cover AWS access key IDs and secret keys, AWS session tokens, Anthropic, OpenAI, and OpenRouter API keys, GitHub classic and fine-grained PATs, GitLab tokens, Google or Firebase API keys, Slack tokens, and SendGrid keys. Matches come from the working tree and from git log -p --all against the full history buffer. Context windows around AKIA and ASIA hits try to pair access key IDs with nearby secret keys. Everything leaves in one POST. Socket highlights kitao/pyxel, an 18,420-star dual-published library, as the clearest case where publishing credentials for PyPI and crates.io plus a GitHub PAT were templated into a successful run. At publication Socket reported no malicious package versions on PyPI or crates.io from this activity, and said the workflow file remained on default branches it checked, including uber/athenadriver and kitao/pyxel.

Socket malware alert describing GhostAction security-audit.yml credential patterns and exfil IP.
Figure: Socket, known-malware alert detail for security-audit.yml harvesting credentials to 193.32.204.199, Oct 9, 2026 (fair use).The alert lists the credential patterns and the hardcoded HTTP destination.

For SOC and CI/CD defenders, Socket's triage starts by reading whether line 15 of the injected file names Actions secrets or carries an empty template. Either way, rotate every credential the history sweep could reach, revoke the maintainer PAT or session that enabled the push, delete the workflow from all branches, and treat completed Security Audit runs as confirmed exfiltration. Hunt egress to 193.32.204.199 on ports 80 and 3000 from hosted and self-hosted runners. Enable secret scanning with push protection, require approval for outside workflow runs, and review organization audit logs for workflow-file additions across every repository the compromised account could write. Fork owners should check for .github/workflows/security-audit.yml before enabling Actions. Rotating current Actions secrets alone does not close exposure to keys deleted from HEAD years ago.

GitHub Actions audit job log for pyxel showing credential greps and HTTP exfiltration.
Figure: Socket via GitHub Actions, kitao/pyxel Security Audit run log with curl POST to 193.32.204.199, Oct 8, 2026 (fair use).A successful pyxel audit run posted harvested material over plain HTTP.

Sources:

Priya Shah covers threat intelligence, adversary tradecraft, and supply-chain campaigns for SOCtember from Singapore.

Related stories

Threat Intel desk