# Hackers deploy GhostAction technique to hide stolen cloud credentials inside GitHub Actions

Unit 42 documents stealthy CI/CD attacks embedding AWS and Azure secrets in repository workflows that trigger on scheduled timers.

- Canonical: https://reviewblip.com/news/hackers-deploy-ghostaction-technique-to-hide-stolen-cloud-credentials-inside-github-actions/
- Published: 2026-10-20T17:01:58.850Z
- Updated: 2026-10-20T17:01:58.850Z
- Author: ReviewBlip
- Category: Privacy & Cloud Security
- Type: News

![Conceptual 3D editorial illustration of an enterprise cloud datacenter with an operator workstation and an illuminated cloud enclosure concealing a hidden actor](https://reviewblip.com/editorial-images/ce51d842d3a9b3034705bc71dff8b69c26875df6c5293f3591072fd2da4ec923)

Image credit: WebProNews / Palo Alto Networks Unit 42 · Security illustration

Cybersecurity researchers at Palo Alto Networks Unit 42 published findings on Tuesday detailing 'GhostAction', an insidious persistence technique targeting GitHub Actions continuous integration and continuous deployment (CI/CD) pipelines. Attackers are embedding stolen AWS access keys, Azure service principal credentials, and cloud secrets directly into workflow YAML configurations and repository secrets to retain persistent cloud access.\[3\]

The attack vector represents a significant evolution in software supply chain subversion. Rather than executing payloads on typical push or pull-request events—which immediately populate developer review logs and trigger security scanners—adversaries configure malicious workflow jobs to run strictly on infrequent scheduled timers or obscure repository conditions. When executed, the runner authenticates directly to corporate cloud environments, executing stealthy data exfiltration, reconnaissance, or cryptomining.\[3\]

Unit 42 observed threat actors gaining initial entry via compromised developer credentials, exposed personal access tokens (PATs), or vulnerable self-hosted runners. Because CI/CD automation scripts frequently carry elevated repository permissions and direct access to production deployments, the injected GhostAction workflows continue operating even after the original compromised developer account is flagged and revoked.\[3\]

Our take: GhostAction exposes a dangerous blind spot in contemporary enterprise security: development automation pipelines are frequently managed with far less rigor than production application code. When long-lived static cloud keys sit embedded in pipeline files, a single compromised contributor can turn an organization's own build server into an unmonitored backdoor. Eliminating static keys in favor of short-lived OpenID Connect (OIDC) identity tokens is no longer optional.

## Sources
- [\[3\] ghostaction](https://www.webpronews.com/ghostaction-attack-hackers-embed-stolen-cloud-credentials-in-github-actions-for-persistent-access/)