GhostAction: hijacked GitHub accounts plant a workflow that steals ai API keys

Attackers behind a campaign called GhostAction have been taking over GitHub maintainer accounts and adding a malicious GitHub Actions workflow, security-audit.yml, to their projects.

• StepSecurity counted more than 340 affected repositories, most through the account of the original author of Uber's athenadriver.
• Socket says more than 500 GitHub accounts have committed the file to tens of thousands of repositories since 7 October.
• The workflow steals cloud credentials and API keys for Anthropic, OpenAI and OpenRouter, sending them over plain, unencrypted HTTP.
• As of 9 October, no malicious packages had been seen on PyPI or crates.io.

GitGuardian reported an earlier wave affecting 772 repositories between late August and September.

Why it matters

Build pipelines are now being raided specifically for ai-provider keys, at scale. A stolen key means someone else's agents running on your bill.