Hackers deploy GhostAction technique to hide stolen cloud credentials inside GitHub Actions
Unit 42 documents stealthy CI/CD attacks embedding AWS and Azure secrets in repository workflows that trigger on scheduled timers.
Technology news
Cybersecurity researchers at Palo Alto Networks Unit 42 published findings on Tuesday detailing 'GhostAction', an insidious persistence technique targeting GitHub Actions continuous integration and continuous deployment (CI/CD) pipelines. Attackers are embedding stolen AWS access keys, Azure service principal credentials, and cloud secrets directly into workflow YAML configurations and repository secrets to retain persistent cloud access.[3]
The attack vector represents a significant evolution in software supply chain subversion. Rather than executing payloads on typical push or pull-request events—which immediately populate developer review logs and trigger security scanners—adversaries configure malicious workflow jobs to run strictly on infrequent scheduled timers or obscure repository conditions. When executed, the runner authenticates directly to corporate cloud environments, executing stealthy data exfiltration, reconnaissance, or cryptomining.[3]
Unit 42 observed threat actors gaining initial entry via compromised developer credentials, exposed personal access tokens (PATs), or vulnerable self-hosted runners. Because CI/CD automation scripts frequently carry elevated repository permissions and direct access to production deployments, the injected GhostAction workflows continue operating even after the original compromised developer account is flagged and revoked.[3]
Our take: GhostAction exposes a dangerous blind spot in contemporary enterprise security: development automation pipelines are frequently managed with far less rigor than production application code. When long-lived static cloud keys sit embedded in pipeline files, a single compromised contributor can turn an organization's own build server into an unmonitored backdoor. Eliminating static keys in favor of short-lived OpenID Connect (OIDC) identity tokens is no longer optional.