GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction hid credential-stealing Node.js malware in fake font files across 94 GitHub repositories.
GhostAction expanded a GitHub credential-theft campaign by hiding unobfuscated Node.js malware in public/fonts/fa-solid-400.woff2 and launching it from .vscode/tasks.json. Jenn Gile found 94 compromised repositories across 66 owners, with the payload confirmed in all 79 repos still available. The stealer collects host details, cloud and package-registry tokens, and SSH private keys, then exfiltrates them by HTTP POST to 193.32.204.199 on port 8080. On cron-capable systems it installs a five-minute job that pulls a hostname-specific script, and earlier workflow cleanup did not stop reinfection.
- 94 repositories owned by 66 accounts were compromised; payload confirmed in 79.
- A .vscode task runs Node.js code hidden as fa-solid-400.woff2 when a trusted folder opens.
- Stealer grabs cloud, npm, PyPI, Git, SSH, Claude, and Gemini credentials, then POSTs them.
- A five-minute cron job marked #ghc2 fetches follow-on scripts and survives repo cleanup.
- Two owners who removed earlier workflows were reinfected; no shared PolinRider indicators found.
- ATT&CK
- T1036.005 Match Legitimate Resource Name or LocationT1059.007 JavaScriptT1552.001 Credentials In FilesT1552.004 Private KeysT1053.003 Cron
- Threat actors
- GhostAction
- Organizations
- Jamf Threat Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.32.204.199 | P POST on port 8080. Jenn Gile linked the infrastructure to 193[.]32[.]204[.]199 . On systems supporting cron, the payload installs a |
| sha256 | 40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c | github/workflows/lint.yml (reference second-stage workflow) 40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c Network 193[.]32[.]204[.]199 GhostAction server Network hxx |
| sha256 | 61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6 | public/fonts/fa-solid-400.woff2 (batch tag auto_20261015 ) 61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6 File public/fonts/fa-solid-400.woff2 (batch tag auto_202610 |
| sha256 | 6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19 | b File .github/workflows/security-audit.yml (first version) 6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19 File .github/workflows/security-audit.yml (second version) |
| sha256 | 92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db | public/fonts/fa-solid-400.woff2 (batch tag auto_20261014 ) 92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db File .vscode/tasks.json a043f03e89ef55779f4f630138cf5efe1dd |
| sha256 | a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb | b028aa9561128d0077a101a1ef4dac0f0db File .vscode/tasks.json a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb File .github/workflows/security-audit.yml (first version) 6 |
| sha256 | cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60 | File public/fonts/fa-solid-400.woff2 (batch tag reinject ) cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60 File public/fonts/fa-solid-400.woff2 (batch tag auto_202610 |
| sha256 | d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f | File .github/workflows/security-audit.yml (second version) d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f File .github/workflows/lint.yml (reference second-stage wor |
| url | http://193.32.204.199:8080/c2/ | //193[.]32[.]204[.]199/?c=new First Stage 1 version Network hxxp://193[.]32[.]204[.]199:8080/c2/<hostname> Script fetched by the cron job Note: IP add |
| url | http://193.32.204.199:8080/?c=auto_20261013 | filtration from the infostealer and second workflow Network hxxp://193[.]32[.]204[.]199:8080/?c=auto_20261013 Exfiltration with a date-stamped batch tag Network hx |
| url | http://193.32.204.199:8080/?c=auto_20261014 | 20261013 Exfiltration with a date-stamped batch tag Network hxxp://193[.]32[.]204[.]199:8080/?c=auto_20261014 Exfiltration with a date-stamped batch tag Network hx |
| url | http://193.32.204.199:8080/?c=auto_20261015 | 20261014 Exfiltration with a date-stamped batch tag Network hxxp://193[.]32[.]204[.]199:8080/?c=auto_20261015 Exfiltration with a date-stamped batch tag Network hx |
| url | http://193.32.204.199:8080/?c=reinject | e7c Network 193[.]32[.]204[.]199 GhostAction server Network hxxp://193[.]32[.]204[.]199:8080/?c=reinject Exfiltration from the infostealer and second workflow |
| url | http://193.32.204.199:8080/?c=security | 20261015 Exfiltration with a date-stamped batch tag Network hxxp://193[.]32[.]204[.]199:8080/?c=security Early Stage 1 variant observed in one repository Netw |
| url | http://193.32.204.199/?c=new | ty Early Stage 1 variant observed in one repository Network hxxp://193[.]32[.]204[.]199/?c=new First Stage 1 version Network hxxp://193[.]32[.]204[. |
From the original article
3 min read at gbhackers.com
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises malicious JavaScript as a font file and targets developer workstations through Visual Studio Code tasks. Jenn Gile identified 94 compromised repositories belonging to 66 owners, confirming the payload in all 79 repositories available for analysis. The remaining 15 were inaccessible.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.