Despite these changes, the IP address (“193.32.204[.]199”) is one indicator of compromise that has been constant, allowing organizations and developers to check if their repositories have been impacted by GhostAction.

“Between October 19 — 21, the attackers also went back to CI with a different goal,” Gile told The Hacker News. “The new workflows are tailored to each repo and list its real secret names, and some request a GitHub OIDC token and try to use it to assume AWS roles. The code looks inert as written, because it depends on a role ARN the files never define, so I can’t say whether it has worked anywhere.”

In a follow-up update shared on October 27, 2026, GitGuardian said the GhostAction operator pushed over 72,000 commits to 22,964 public repositories between October 13 and 21, 2026, out of which 7,989 are new victims.