GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction hid credential-stealing Node.js malware in fake font files across 94 GitHub repositories.
76
Organization
Jamf Threat Labs
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenSep 23, 2026
- Last mentioned25d ago
Timeline
4 articles · newest firstCloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer
Jamf found CloudSyncD, a macOS backdoor in a fake Zoom installer that captures a password to launch its payload.
56
Fake Crypto Wallet App Delivers PamStealer Malware That Hijacks Mac Credentials
A new PamStealer variant for macOS spreads via a fake crypto wallet, using server-assisted decryption to steal credentials, Keychain data, and crypto assets.
55
Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords
A fake Mac crypto-wallet app delivers new PamStealer malware that steals passwords and browser credentials.
61
Appears with
- Applevendor · 3
- macOSproduct · 2
- PamStealermalware · 2
- Wavelproduct · 1
- CloudSyncDmalware · 1
- GhostActionthreat actor · 1
- Jamfvendor · 1
- Microsoftvendor · 1
- GitHub Actionsproduct · 1
- GitHubproduct · 1
- Zoomproduct · 1
- Visual Studio Codeproduct · 1
- GitHubvendor · 1
- MacClientmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.