GHOSTACTION has expanded its supply‑chain campaign by disguising a credential stealer as a font file and deploying it via 94 compromised GitHub repositories. OpenSourceMalware reports that attackers now phish open‑source developers using a fake font hosted under a domain pattern linked to the operation, while exfiltrating credentials through a malicious workflow.
In the latest wave, the threat actor registered my-github[.]com and pointed it at a GitHub‑related IP (193.32.204[.]199), which also serves as the exfiltration endpoint for data harvested from the malicious workflow. The phishing page acts as a reverse proxy, harvesting the victim’s password and a 2FA code, then automatically authorising a GitHub OAuth app with broad permissions (repo, workflow, read:org) to modify workflows and gain access to repositories and organisation data.
OpenSourceMalware notes that the campaign’s second stage persists on developer machines even after the original workflow is removed. It drops three components: a VS Code tasks[.]json set to run on folderOpen, a font file at public/fonts/fa-solid-400.woff2 containing the stealer payload (targeting AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH keys, and credentials for Anthropic Claude and Google Gemini), and a second GitHub Actions workflow that activates if the infostealer never runs.
The 94 compromised repositories span 66 owners, with 15 having since been deleted, renamed, or made private; many repositories show little recent activity. To mitigate, developers are advised to revoke GitHub access and tokens, rotate credentials reachable by workflows, audit repos, and alert collaborators who have cloned the code. The report notes that GitHub stopped the original malicious workflow from running on 9–12 October, with Stage 2 arriving days later.