Update Oct 19: OpenSourceMalware reports that GhostAction has moved past CI workflows. The lookalike domain my-github[.]com (registered Oct 9) resolves to the GhostAction collector 193.32.204[.]199. It was used in a personalised fake "[GitHub] New sign-in from Moscow, Russia" email to an open-source maintainer. The linked page reverse-proxied GitHub, captured the password and 2FA code, and silently approved a GitHub OAuth device flow with repo, workflow and read:org scopes, sending the token to my-github[.]com:8443. A related watchlist domain, my-gitlab[.]com (registered Sep 22), isn't proven to be the same operator. Separately, Jamf's Thijs Xhaflaire found a 'stage 2' in 94 repositories. It's a .vscode/tasks.json task labelled eslint-check set to runOn: folderOpen, which runs public/fonts/fa-solid-400.woff2 as plain Node.js. That script steals AWS, PyPI, npm, git, netrc, Claude, Gemini and kube credentials plus SSH keys, POSTs them to the same IP on port 8080, and installs a #ghc2 cron job that fetches and runs a script every 5 minutes. Stage 2 copies North Korea's PolinRider launcher, but OpenSourceMalware labels it a copycat, not DPRK. A second fallback workflow (lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml) can exfiltrate to a secret gist. If you opened an affected repo in VS Code: remove the cron entry, rotate everything listed, and revoke GitHub tokens and OAuth apps from a clean device.

Earlier (Oct 13):

GitGuardian's Oct 13 update says the GhostAction GitHub Actions campaign spiked Oct 8–9, using about 1,900 compromised GitHub accounts to push malicious workflows into more than 30,000 repositories across about 3,000 users and orgs, attempting to extract 3,174 secrets from CI. The new payload (workflow named "Security Audit") also greps the working tree and full git history for AWS keys, GitHub/GitLab PATs, AI provider keys and other cloud secrets, then POSTs them over plain HTTP to 193.32.204.199. GitHub began blocking the workflow from running on Oct 9, so waves on Oct 10 and 12 extracted nothing. An earlier Aug 31–Sept 30 wave hit 772 repos. GitGuardian notes many victims were hit in earlier waves too and that leaked GitHub credentials are being reused by several unrelated actors, so rotate the exposed secrets and revoke the GitHub credential used for the injection.