The group behind the GhostAction supply chain attack has moved past malicious GitHub Actions workflows, now phishing open-source developers and slipping a credential stealer inside a fake font file, according to research from OpenSourceMalware.

The attackers registered my-github[.]com on October 9, 2026, pointing it at 193.32.204[.]199 - the same IP used to exfiltrate data from the malicious workflow. That same day, the domain was used in an email impersonating a GitHub security alert, warning an open-source maintainer of a login from Moscow and urging them to secure their account.

The fake page worked as a reverse proxy, capturing the victim's password and 2FA code while silently authorizing a GitHub OAuth app with repo, workflow, and read:org scopes. A script automated the device-code and approval steps, so the victim never had to type a code or consciously approve the app, and the stolen token was sent to the same server on TCP/8443.

A second stage persists on developer machines even after the workflow is removed. It commits a VS Code tasks.json with a folderOpen trigger, a file named public/fonts/fa-solid-400.woff2 containing a stealer that harvests AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH private keys, and Anthropic and Google Gemini credentials, plus a backup CI workflow under names like lint.yml and ci-check.yml. The stealer also installs a cron job running attacker code every five minutes.

Researchers identified 94 compromised repositories belonging to 66 owners; 15 have since been deleted, renamed, or made private, and most of the rest appear abandoned. GitHub began blocking the malicious workflow on October 9, and waves on October 10 and 12 extracted no secrets. "We can't say the block caused it," OpenSourceMalware said. "We can say the operator moved to a place GitHub's controls don't reach."

Co-founder Jenn Gile said the operator's identity is unknown but their work suggests limited experience, noting the stealer's environment-variable filter misses most API keys and a single IP handles exfiltration, phishing, and noisy scanning. Recommended mitigations include revoking GitHub access and tokens from a clean device, changing passwords, auditing repositories, rotating every credential the workflows could reach, and alerting users who cloned the repos.

Source: The Hackers News