GCVE-110-OSM-2026-14246

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a workflow that searches the repository and its git history for credentials and sends them to the attacker's server (added August 31, 2026). The workflow runs on pushes and sends what it finds when GitHub lets it run. An earlier GhostAction workflow, first pushed September 1, 2025, is also in its history, so the account was compromised before the October 2026 wave. ## Payload 1: workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/security-audit.yml` First pushed October 8, 2026. A GitHub Actions workflow named like a security check. It runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns (AWS, Anthropic, OpenAI, GitHub, Google, Slack and similar), and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag in the query string. It installs nothing. ## Payload 2: shortened workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/build-check.yml` First pushed October 16, 2026. A GitHub Actions workflow that runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns, and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. It is a trimmed copy of the second-stage workflow, without the wiki search or the gist fallback. It installs nothing. ## Payload 3: second workflow that searches the repository, its history and its wiki Malicious payload found in: `.github/workflows/ci-check.yml`, `.github/workflows/lint.yml`, `.github/workflows/test-suite.yml` First pushed October 14, 2026. Updated 2 times afterwards. A GitHub Actions workflow that runs on every push and on manual dispatch. It checks out the full git history, searches the working tree, every commit (`git log -p --all`) and the repository's wiki (cloned with the job's `GITHUB_TOKEN`) for credential patterns, and sends the result with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. If that request fails it creates a private gist containing the same data through the GitHub API using `GITHUB_TOKEN`. Many versions also add named repository secrets (`${{ secrets.NAME }}`) to the upload. The attacker used a different file name and display name in different repositories. It installs nothing. ## Payload 4: workflow that sends named repository secrets Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed August 31, 2026. Updated 1 time afterwards. A small GitHub Actions workflow (job `send-secrets`, step `Prepare Cache Busting`, the same names as the 2025 GhostAction workflow) that runs on every push and on manual dispatch and sends a list of named repository secrets (`NAME=${{ secrets.NAME }}`) with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag on later versions. The secret names differ from repository to repository. It does not search the repository or its history and installs nothing. ## Payload 5: workflow that echoes secrets and asks for a CI token for AWS Malicious payload found in: `.github/workflows/ci-check.yml` First pushed October 19, 2026. A GitHub Actions workflow (job `deploy`, with `id-token: write`) that runs on every push and on manual dispatch. It lists named repository secrets in the job environment, writes their values to a report, requests a GitHub Actions OIDC token for the audience `sts.amazonaws.com`, and loops over a list of IAM role ARNs that is empty in every copy we found, so the AWS exchange never runs. It sends the report with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with the batch tag `full1`, and installs a crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server and runs it with `bash`. ## Payload 6: self-hosted-runner workflow that sends secrets and credential files Malicious payload found in: `.github/workflows/cleanup_cache.yml` First pushed October 20, 2026. A GitHub Actions workflow that runs on a self-hosted runner. It writes the values of named repository secrets, reads `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials`, `~/.claude/.credentials.json` and the SSH private keys, and sends everything with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. It also installs a crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server and runs it with `bash`, so it keeps working on the runner after the workflow ends. ## Payload 7: September 2025 style workflow that sends named secrets Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed September 1, 2025. Updated 1 time afterwards. A small GitHub Actions workflow (job `send-secrets`, step `Prepare Cache Busting`) in the style of the first GhostAction wave. It runs on pushes and sends a list of named repository secrets (`NAME=${{ secrets.NAME }}`) with `curl` to an attacker-controlled host. In the copies found in this repository the destination is one of the 2025 exfiltration hosts (`bold-dhawan[.]45-139-104-115[.]plesk[.]page`, `carte-avantage[.]com` or `170[.]39[.]218[.]2`), not the server used in October 2026.