GhostAction returns with full-history credential theft
StepSecurity reported that compromised maintainer accounts pushed a malicious Security Audit workflow across 345 repositories on 8 October. The workflow exfiltrates named Actions secrets and searches the working tree plus full Git history for cloud, GitHub, GitLab, Slack, SendGrid and AI-provider credentials; an observed run received an acknowledgement from the attacker's server.
Why it matters: Deleting a leaked key from the current tree is insufficient when a workflow can mine every branch and tag. Direct-to-default-branch commits under legitimate maintainer identities also weaken identity-only audit signals.