/
← Voltar ao feed
high technology software development

GhostAction operators phish GitHub maintainers and plant font-disguised stealer in 94 repositories

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 10:05 · coletado há 2 dias

The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, after which the October 10 and 12 waves extracted no secrets. A total of 94 repositories belonging to 66 owners were found carrying the second-stage component. The operator is unidentified and, per OpenSourceMalware, shows limited experience.

Detalhes técnicos

  • Phishing: the domain my-github[.]com was registered on October 9, 2026 and resolves to 193.32.204[.]199, which is also the exfiltration endpoint for the malicious workflow. A fake GitHub security alert (from noreply@my-github[.]com, claiming a login from Moscow) was sent to a maintainer the same day. The page acts as a reverse proxy that harvests the password and 2FA code, then injects JavaScript that silently completes a GitHub OAuth device flow with repo, workflow and read:org scopes. The resulting token is exfiltrated to my-github[.]com on TCP/8443 and allows repository enumeration and injection of workflows under .github/workflows/.
  • Second stage: three files are committed. A VS Code tasks.json with a runOn: folderOpen trigger auto-runs the payload. public/fonts/fa-solid-400.woff2 holds the stealer, whose file name matches one used in North Korea's PolinRider campaign (January 2026). A second GitHub Actions workflow runs if the stealer never executes.
  • Stealer: it targets AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH private keys and AI provider credentials (Anthropic Claude, Google Gemini). It installs a cron job that runs attacker-supplied code every five minutes and sends data over plain HTTP on port 8080. The second workflow adds credential formats and falls back to uploading findings to a secret gist.
  • Related infrastructure: my-gitlab[.]com (registered 17 days earlier) follows the same naming pattern, but no infrastructure links it to GhostAction.
  • Scope: of the 94 repositories, 15 have been deleted, renamed or made private; most of the rest were abandoned, and 65 of 79 had no commit for over a year.

Remediação

Revoke GitHub access and tokens from a clean device, change passwords, audit repositories, and rotate every credential the workflows can reach. Alert users who cloned affected repositories. Searching for the exfiltration IP can still reveal infections.

Linha do tempo

  1. thehackernews.com ↗ · pub. 19/10/2026 10:05 · coletado 19/10 17:53 primeiro registro

    GhostAction operators phish GitHub maintainers and plant font-disguised stealer in 94 repositories

    ler a análise desta fonte

    The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, after which the October 10 and 12 waves extracted no secrets. A total of 94 repositories belonging to 66 owners were found carrying the second-stage component. The operator is unidentified and, per OpenSourceMalware, shows limited experience.

    Technical Details

    • Phishing: the domain my-github[.]com was registered on October 9, 2026 and resolves to 193.32.204[.]199, which is also the exfiltration endpoint for the malicious workflow. A fake GitHub security alert (from noreply@my-github[.]com, claiming a login from Moscow) was sent to a maintainer the same day. The page acts as a reverse proxy that harvests the password and 2FA code, then injects JavaScript that silently completes a GitHub OAuth device flow with repo, workflow and read:org scopes. The resulting token is exfiltrated to my-github[.]com on TCP/8443 and allows repository enumeration and injection of workflows under .github/workflows/.
    • Second stage: three files are committed. A VS Code tasks.json with a runOn: folderOpen trigger auto-runs the payload. public/fonts/fa-solid-400.woff2 holds the stealer, whose file name matches one used in North Korea's PolinRider campaign (January 2026). A second GitHub Actions workflow runs if the stealer never executes.
    • Stealer: it targets AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH private keys and AI provider credentials (Anthropic Claude, Google Gemini). It installs a cron job that runs attacker-supplied code every five minutes and sends data over plain HTTP on port 8080. The second workflow adds credential formats and falls back to uploading findings to a secret gist.
    • Related infrastructure: my-gitlab[.]com (registered 17 days earlier) follows the same naming pattern, but no infrastructure links it to GhostAction.
    • Scope: of the 94 repositories, 15 have been deleted, renamed or made private; most of the rest were abandoned, and 65 of 79 had no commit for over a year.

    Remediation

    Revoke GitHub access and tokens from a clean device, change passwords, audit repositories, and rotate every credential the workflows can reach. Alert users who cloned affected repositories. Searching for the exfiltration IP can still reveal infections.