Blocked malicious workflows did not eliminate the accounts behind the GhostAction supply-chain campaign. Attackers pushed 72,000 commits to 23,000 public repositories between October 13 and 21, including 8,000 new targets. GitHub prevented the workflows from executing, yet researchers found persistent access to nearly 1,800 compromised accounts. Of 1,792 accounts, 1,382 had already been used in an earlier wave, showing that stolen tokens remained valid.
Why It Matters
The attempted payloads sought repository secrets, publishing tokens, source-code credentials, cloud access, and developer-machine credentials. This wave was largely ineffective, and there was no evidence the copied local stealer ran, but compromised accounts still leave room for revised attacks. For leaders: blocked execution should not be mistaken for completed recovery. For defenders: remove malicious files on every branch, revoke account tokens, and rotate repository, Actions, wiki, and exposed credentials. The larger lesson is that response must remove persistent access, not just stop one payload.
What Defenders Should Do
Audit affected repositories now and invalidate every credential linked to a compromised developer account.