GhostAction: a secret deleted from the repo is still in the repo
You have committed a password by mistake before. So have I. You deleted it in the next commit and moved on. Since October 7, an attack has been looking for exactly those secrets. The ones you think are gone. TL;DR : the GhostAction campaign is back on GitHub. Its fake workflow no longer steals only the repository secrets. It digs through the whole git history and collects secrets deleted years…
GhostAction, a credential theft campaign, has returned on GitHub. The attack targets GitHub Actions and has been searching for secrets hidden in the repository's history. In October 2025, a malicious workflow was introduced by the attackers, who could now download the entire repository history and search for secrets. This new version of GhostAction has compromised two well-known maintainer accounts, resulting in the theft of 345 repositories.
To protect against this threat, developers should revoke or change any compromised secrets immediately, rather than focusing on cleaning up the history. Additionally, they should revoke the GitHub token that allowed the attacker access and ensure that the token used for the stolen credentials is no longer valid. Finally, it is crucial to restrict the permissions of any stolen tokens and avoid using workflows that have access to sensitive resources.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
