GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens
The GhostAction campaign has returned with a significantly broader technique for stealing credentials from open-source projects. On October 8, two compromised maintainer accounts injected a malicious workflow into 346 GitHub repositories, including prominent projects such as uber/athenadriver and kitao/pyxel, the latter holding more than 18,000 stars.
The injected file is named security-audit.yml and is accompanied by a commit message referencing a security audit. This disguise reduces the likelihood that legitimate maintainers will notice the change, as it appears to be a protective routine rather than an obvious attack.
The workflow executes automatically on every code push without requiring any action from the repository owner. It collects credentials and transmits them via HTTP requests to servers controlled by the attackers. The key evolution from prior waves is the expanded scope of data collection: the malicious workflow now scans both the working tree and the complete git history to locate credentials that may have been accidentally committed in older changes.
The list of targeted credentials includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens.
The October 8 activity forms part of a larger operation. Since October 7, more than 500 GitHub accounts have planted workflows of this type. Earlier campaigns compromised 817 repositories in September 2025 and another 772 repositories between August and September of the same year.
Security researchers recommend that maintainers revoke all active GitHub sessions, personal access tokens, OAuth grants, and SSH keys. Additional steps include scanning the entire git history for exposed secrets, reviewing GitHub Actions execution logs, and enforcing strict review requirements for any modifications to the workflows directory.
Related articles
GitHub Repo Trap with 1774 Stars Mimics Microsoft Activation Scripts to Deliver Malware via Telegram Bot
A security researcher built a Telegram bot that daily delivers five trending GitHub repositories from trendshift.io along with README summaries. One repository named Microsoft Activation Scripts contained only a README with a reversed PowerShell command that decoded to download and execute a payload from a lookalike domain. The account was created 94 seconds before the repository and used classic one-liner installation syntax to blend with legitimate projects. Analysis of 321 trending repositories showed that simple filters such as recent account age or irm|iex patterns would incorrectly flag many legitimate projects including codex and opencode. Two independent detection rules were developed: one that normalizes and scans for obfuscated execution commands including base64, mshta, certutil and hidden window flags, and another that flags one-time owners created less than 30 days before the repository with under 10 KB of content. An additional groundedness check using the AIHOT method prevents DeepSeek from inserting unverified claims such as Ruby or Cypress into repository summaries.
Security Researcher Builds SAST Scanner for AI-Generated Code and Audits 3,800 Public Repositories
A developer released AigisSAST, a lightweight open-source static analysis tool written in pure Python with no external dependencies, specifically tuned to detect common mistakes made by AI coding assistants. The scanner was run across roughly 3,800 repositories ranging from small pet projects to popular open-source platforms. It identified thousands of potential secrets and misconfigurations, yet manual review reduced the number of genuine leaks to approximately 30 cases, mostly Telegram bot tokens, database credentials, and committed .env files. The project also examined 471 production-grade Telegram bots handling payments and VPN services, uncovering 31 repositories that exposed real credentials either in current code or in Git history. AigisSAST includes 21 detection rules, 193 regression tests, automatic remediation via the fix command, and seamless integration with GitHub Actions. The author deliberately avoided validating any discovered keys to stay within ethical research boundaries.
Vendor Responsibility in Open Source: Licensing Obligations Exposed by Sonatype Nexus Changes
The article examines how vendors building products on copyleft open source projects like Nexus Repository OSS inherit significant legal and security responsibilities under licenses such as EPL 1.0. Sonatype's February 2025 shift from regular OSS binary releases to a limited Community Edition forces downstream vendors to handle their own builds, patch porting, and compliance disclosures. This change highlights the second part of copyleft licenses that outlines obligations for distributors, including revealing modifications and assuming liability for the final product. Security implications arise because critical vulnerabilities in the upstream project must now be tracked and patched by the vendor, with delays creating measurable supply chain risks. The piece provides a practical checklist for buyers to assess licensing hygiene, SBOM availability, and vulnerability response times in any open source-based solution.
PhantomSub Campaign Deploys 101 Malicious npm Packages to Hijack WhatsApp Accounts for Unauthorized Channel Subscriptions
Researchers at OX Security uncovered 101 malicious npm packages tied to the PhantomSub campaign that abuse connected WhatsApp accounts to subscribe users to promotional channels without consent. The packages disguise themselves as modified versions of the open-source Baileys library used for WhatsApp automation. Attackers rely on authenticated sessions rather than simple package installation, allowing them to control subscriptions through lists stored on GitHub, in plaintext, or as encoded identifiers. The packages have accumulated roughly 490,000 downloads, including 116,000 in the past 30 days, though the exact number of compromised accounts remains unknown. As of 28 September, npm had removed only 16 of the identified packages. The operation ultimately benefits channels selling bots, game resources, accounts, and promotion services by inflating subscriber counts while disabling notifications to hide the activity.