opensourcemalware.comPublished
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
Excerpt
We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub access to push a fake “security audit” workflow into every repository an account can write to, and the workflow sends the repo’s secrets and any credentials found in its git history to the attacker’s server.
New Stage 2: Commit a tasks.json file and public/…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by opensourcemalware.com on opensourcemalware.com.
Mentioned in the excerpt
More from opensourcemalware.com4
- WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentialsopensourcemalware.com · Published 17 Sep
- ChainVeil and ViteVenom are DPRK’s PolinRider Campaignopensourcemalware.com · Published 17 Jul
- PolinRider Confirmed Footprint Grows 6.5x Since Marchopensourcemalware.com · Published 15 Jul
- Lazarus Group Uses Git Hooks To Hide Malwareopensourcemalware.com · Published 6 May
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
