GhostAction hides credential stealer as font file in 94 GitHub repositories

The threat actor behind the GhostAction supply chain campaign has moved beyond malicious GitHub Actions workflows and is now phishing open-source developers and committing a credential stealer disguised as a font file to compromised repositories, according to research from OpenSourceMalware reported by The Hacker News on October 19. The researchers identified the new second-stage component in 94 repositories belonging to 66 owners, and say the shift followed GitHub's move to block the original workflow.

What happened

According to the report, GitHub began blocking GhostAction's malicious workflow on October 9, 2026, and attack waves on October 10 and 12 extracted no secrets. The second stage appeared six days after the block. The researchers say they cannot prove the block caused the change, but the operator moved to a method that GitHub's controls do not cover.

The same day, the actor registered my-github[.]com, pointing it to 193.32.204[.]199, the IP address also used as the exfiltration endpoint by the original workflow. The domain was used in a phishing email impersonating a GitHub security alert about a supposed login from Moscow, sent to an open-source maintainer. The Hacker News separately reported that GhostAction has compromised about 1,900 GitHub accounts and targeted more than 30,000 repositories.

Technical details

The fake login page works as a reverse proxy that captures the victim's password and two-factor code, The Hacker News said. Injected JavaScript silently authorizes a GitHub OAuth device flow with repo, workflow and read:org scopes, without the victim entering a device code or approving an app. The resulting token gives reusable API access to repositories, workflow files and organization data.

The second stage commits three files: a VS Code tasks.json set to run on folder open, a stealer at public/fonts/fa-solid-400.woff2, and a backup GitHub Actions workflow. The stealer targets AWS keys, npm and PyPI tokens, Git logins, Kubernetes credentials, SSH private keys and Anthropic and Google Gemini credentials, then installs a cron job that runs attacker-supplied code every five minutes. The report notes the file name matches one used in North Korea's PolinRider campaign earlier this year. Backup workflows use names such as lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml and cache-cleanup.yml.

Of the 79 repositories still accessible, 65 had no commits for over a year. Jenn Gile of OpenSourceMalware said the operator's work suggests limited experience.

What to do

The researchers advise affected developers to revoke GitHub access and tokens from a clean device, change passwords and strengthen account protection, audit repositories for the files and workflow names above, rotate every credential the workflows could reach, and notify anyone who cloned the affected repositories. Developers should be wary of GitHub security alerts that link to look-alike domains.