GhostAction plants font-disguised stealer in 94 GitHub repositories
Original title: GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
Phishing via my-github.com steals GitHub passwords, 2FA, and OAuth tokens, then a VS Code task runs a credential stealer.
OpenSourceMalware says the GhostAction operator moved from malicious GitHub Actions workflows to phishing maintainers and a second-stage stealer after GitHub began blocking the workflow on October 9, 2026. A fake alert from noreply@my-github.com proxied logins, captured passwords and 2FA codes, and silently approved an OAuth device flow. Compromised repos add a VS Code task that opens a fake font harvesting cloud, package, SSH, and AI credentials, plus a cron job every five minutes. The 94 repositories span 66 owners, and many look abandoned.
Unconfirmed: Whether my-gitlab.com is run by the same actor is unconfirmed, and researchers do not claim GitHub's block caused stage two.
- my-github.com was registered on October 9, 2026 and pointed at 193.32.204.199.
- The OAuth grant requests repo, workflow, and read:org scopes.
- Collected data is sent to the same server over plain HTTP on port 8080.
- Fifteen of 66 owners later deleted, renamed, or made repositories private.
- Sixty-five of 79 still-accessible repositories had no commit for more than a year.
Impact: Steals cloud, registry, SSH, and AI provider credentials
- 1.Revoke GitHub access and tokens from a clean device and change passwords.
- 2.Audit repositories for the fake font and named malicious workflow files.
- 3.Rotate AWS, PyPI, npm, Kubernetes, SSH, and AI provider credentials.
- ATT&CK
- T1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1195.002 Compromise Software Supply ChainT1053.003 Cron
- Vendors
- Microsoft
- Threat actors
- GhostAction
- Organizations
- OpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | my-github.com | lligence platform, the threat actor registered the domain " my-github[.]com " and pointed it at " 193.32.204[.]199 ," the same IP add |
| domain | my-gitlab.com | e domain was registered on October 9, 2026, 17 days after " my-gitlab[.]com " was registered. It's unclear if the latter code-hosting |
| ipv4 | 193.32.204.199 | gistered the domain " my-github[.]com " and pointed it at " 193.32.204[.]199 ," the same IP address that's used as an exfiltration end |
From the original article
4 min read at thehackernews.com
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.