Cybersecurity
GhostAction attackers hide stealer in 94 GitHub repositories
OpenSourceMalware said GhostAction shifted from malicious GitHub Actions workflows to phishing and a fake font payload, after GitHub blocked parts of the campaign, with 94 repositories later identified.
- OpenSourceMalware said GhostAction had moved from malicious GitHub Actions workflows to phishing and a fake font-file payload.
- It said my-github[.]com was registered on 9 October 2026 and pointed to the same IP used for data exfiltration from the workflow.
- The same domain was used that day in an email that imitated a GitHub security alert and targeted an open-source maintainer.
- OpenSourceMalware said the campaign affected 94 repositories across 66 owners, and 15 owners later deleted, renamed or privatised those repositories.
- OpenSourceMalware said GitHub began blocking the malicious workflow on 9 October, and attacks on 10 and 12 October did not extract secrets.
OpenSourceMalware said GhostAction had moved beyond malicious GitHub Actions workflows and was now using phishing and a fake font file to reach developers. The group said my-github[.]com was registered on 9 October 2026 and pointed to the same IP address used for earlier exfiltration.
The domain was used that day in an email that imitated a GitHub security alert and tried to lure an open-source maintainer. OpenSourceMalware said the landing page stole a password and 2FA code, then used the victim's session to authorise an OAuth app and a device-flow approval.
That token would have given reusable API access to repositories and matched the earlier workflow abuse. OpenSourceMalware said the second stage came through a VS Code task file, a font file under public/fonts/fa-solid-400.woff2 and a fallback workflow.
OpenSourceMalware said it found the second stage in 94 repositories across 66 owners, and 15 of those owners later removed, renamed or privatised their repositories. It said GitHub began blocking the malicious workflow on 9 October, and the attacks on 10 and 12 October did not extract secrets.
Jenn Gile said the operator did not appear highly experienced and recommended revoking access, changing passwords and rotating credentials from a clean device. She said a single IP still linked exfiltration, phishing and scanning activity.
Named in this story
People
- Paul McCarty
- described the infrastructure and the automated OAuth flow
- Jenn Gile
- said the operator appeared to have limited experience
Companies
- GitHub
- was the platform targeted by the campaign and blocked the malicious workflow
Organisations
- OpenSourceMalware
- published the analysis and attributed the campaign details
Products and systems
- GitHub Actions
- was the workflow system abused in the attack
- VS Code
- ran the task file that auto-started the stealer
- Anthropic Claude
- was one of the AI services whose credentials the stealer sought
- Google Gemini
- was another AI service whose credentials the stealer sought
- Kubernetes
- was among the credential targets listed by the stealer
Places
- North Korea
- was cited as the source of a similar file name and tactic
- Moscow, Russia
- was named in the phishing message as the supposed login location
How the source tells it
The article was written in an urgent, cautionary register, combining escalation language with concrete defensive advice.
- urgency it paired fresh attack details with immediate mitigation steps and time-linked attack waves
- alarm it framed each new stage as a worsening of the same campaign