GhostAction hackers plant 72,000 malicious commits across 22,964 GitHub repositories
Researchers say the GhostAction campaign quietly pushed more than 72,000 malicious commits into 22,964 GitHub repositories via 1,792 compromised accounts, with payloads aimed at CI/CD secrets, developer machines and cloud credentials.
A large software supply‑chain attack has reached far deeper into the development ecosystem than first understood, with researchers tying tens of thousands of code changes on GitHub to a single operation known as GhostAction.
Updated figures released on 28 October show that GhostAction operators targeted 22,964 GitHub repositories, using 1,792 compromised accounts to push over 72,000 malicious commits. The code they added was designed to steal sensitive data at the core of modern software production: secrets used in continuous integration and continuous deployment (CI/CD) systems, information from developer machines and cloud credentials.
By abusing stolen GitHub access tokens, the attackers submitted changes that appeared to come from legitimate contributors. In many projects, especially large or fast‑moving ones, such commits may not receive close scrutiny, which gave the campaign opportunities to slip credential‑harvesting code into widely used repositories.
Researchers have identified at least five distinct payload families in the operation. Some variants focus on collecting environment variables, which often hold API keys and passwords for automated build and deployment pipelines. Others go after configuration files or browser data on developer workstations, where single sign‑on tokens and cloud access details can be stored.
Organizations that rely on open‑source components and shared code face heightened risk when a dependency contains hidden exfiltration logic. A seemingly minor upstream change can become the starting point for a breach that reaches into production systems or internal tools.
GitHub offers mechanisms to detect unusual activity and revoke compromised tokens. Even so, researchers warn that some access tokens stolen in earlier phases of GhostAction are still being reused, which means that repositories that have already removed known malicious commits may see renewed attempts to regain entry.
The campaign unfolds against growing concern about how attackers can compromise widely used software by tampering with the development pipeline rather than attacking finished products. GhostAction’s reach, touching tens of thousands of repositories, illustrates how dispersed and hard to track such efforts can be when they exploit normal collaboration patterns across many projects.
Software supply‑chain security now sits alongside more familiar threats like phishing and ransomware for any organization that writes or integrates code. The next indications to watch are whether major cloud and platform providers publish detailed lists of affected repositories, whether regulators push for tighter controls on developer credentials, and how quickly development teams rotate tokens, audit past commits and reinforce their CI/CD setups against similar attacks.
Sources
- OSINT