Update Oct 19 (stage 2 + phishing): (1) In repos: .vscode/tasks.json with "runOn": "folderOpen" running node ./public/fonts/fa-solid-400.woff2 (label eslint-check), plus new workflows named lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml or test-suite.yml. (2) On dev machines: crontab lines containing #ghc2 or curl ... http://193.32.204.199:8080/c2/, and node processes launched by VS Code reading .aws/credentials, .npmrc, .pypirc, .claude/.credentials.json or .gemini/oauth_creds.json. (3) Egress: HTTP to 193.32.204.199 on ports 80, 8080 and 8443, and DNS for my-github[.]com or my-gitlab[.]com and their subdomains. (4) GitHub: OAuth device-flow authorizations granting repo, workflow and read:org to unknown apps (check Settings → Applications → Authorized OAuth Apps and org audit logs).

Earlier (Oct 15):

Across your GitHub orgs, search for workflow files and commits matching GhostAction: workflow names "Security Audit", "Github Actions Security" or "Security Check"; files github_actions_security.yml, security-audit.yml, security-check.yml; commit messages "Add Github Actions Security workflow" / "Update Github Actions Security workflow"; and any curl POST to 193.32.204.199 (also older endpoints 170.39.218.2, carte-avantage.com, *.plesk.page). Use the org audit log for workflow-file commits pushed via API by users who don't normally touch CI, and Actions run history for jobs that ran git log -p --all and grep for AKIA/ASIA. Egress logs: outbound HTTP from runners to 193.32.204.199. If found, rotate every secret the workflow referenced or could grep from history, and revoke the pushing account's PATs/SSH keys and sessions.