GhostAction Attackers Deploy Credential Stealer via Fake Font Files
Malicious actors evolve supply chain tactics by targeting developers through GitHub repository compromises.
1Evolution of GhostAction Tactics
The GhostAction threat actor has shifted strategies following GitHub's intervention against malicious workflows. By registering the domain my-github.com on October 9, 2026, attackers now utilize reverse proxy phishing pages. This infrastructure allows them to harvest passwords and 2FA codes while silently authorizing OAuth applications to maintain persistent access to targeted repositories.
2Automated OAuth Device Phishing
The attack utilizes a sophisticated reverse proxy that automates the GitHub device code flow. By injecting JavaScript, the attacker forces the victim's session to authorize an OAuth app with broad scopes, including repository and workflow permissions. This bypasses the need for manual user approval, granting attackers reusable API credentials for further exploitation.
3Persistence via VS Code
Beyond workflow injection, the campaign now deploys a second-stage component disguised as a font file. This malware forces VS Code to execute a credential stealer upon opening, establishing a cron job that runs every five minutes. This persistent mechanism ensures data exfiltration continues even if the initial malicious GitHub workflow is removed.
4Scope of Repository Compromise
Research identifies 94 compromised repositories across 66 distinct owners. Many of these targets appear to be abandoned projects, with 65 of the 79 accessible repositories lacking commits for over a year. Attackers leverage these neglected codebases to hide malicious files, effectively using them as staging grounds for broader supply chain infiltration attempts.
5Infrastructure and Attribution Challenges
The attacker uses a single IP address, 193.32.204.199, for both phishing and data exfiltration. While the domain my-gitlab.com was registered 17 days prior, security experts find no direct infrastructure links to GhostAction. The operator relies on different registrars and DNS designs, complicating efforts to definitively attribute the campaign to a single entity.
6Operational Security Flaws
Despite the technical complexity, the operator exhibits limited experience. The stealer's environment-variable filter frequently misses critical API keys, and its home-directory search often times out. Furthermore, the use of a single IP address for noisy internet scanning and phishing allows security researchers to easily track and identify active infections across the network.
7Mitigation and Recovery Steps
Developers must immediately revoke all GitHub access tokens from a clean device and perform a mandatory password reset. Auditing repositories for unauthorized workflow files and rotating every credential reachable by these workflows is essential. Organizations should also notify downstream users who may have cloned the compromised repositories to prevent further spread of the malware.
8Strategic Security Implications
This campaign highlights the vulnerability of open-source supply chains to automated credential theft. By moving beyond simple workflow injection to persistent local machine compromise, attackers demonstrate a clear intent to maintain long-term access. Organizations must prioritize attack surface visibility and strictly control OAuth permissions to mitigate risks from such evolving threat actors.