GhostAction Attackers Hide Credential Stealer in Fake Font Across 94 GitHub Repositories

A supply-chain attack tracked as GhostAction has evolved, targeting open-source developers through phishing emails, malicious GitHub Actions workflows, and a credential stealer disguised as a font file. According to OpenSourceMalware, the latest campaign placed a second-stage component in 94 compromised GitHub repositories, creating risks for developers and their connected cloud and software accounts.

How the GhostAction Attack Works

The attackers registered a deceptive domain, my-github[.]com, and used it to send a fake GitHub security alert. The phishing message warned a developer about a suspicious login and directed them to a fraudulent login page designed to capture account credentials and two-factor authentication codes.

Researchers reported that the phishing infrastructure could also abuse GitHub OAuth authorization to obtain tokens with permissions to access repositories and modify workflow files. These permissions could allow attackers to introduce malicious automation into projects.

Fake Font File Delivers Credential-Stealing Malware

The campaign’s second stage uses a Visual Studio Code configuration file named tasks.json, configured to run when a project folder opens. It launches a payload concealed inside a file named fa-solid-400.woff2, which appears to be a font.

According to OpenSourceMalware, the stealer targets sensitive developer credentials, including AWS keys, PyPI and npm tokens, Git credentials, Kubernetes credentials, SSH private keys, and AI provider credentials associated with services such as Anthropic Claude and Google Gemini.

The malicious component reportedly establishes persistence by creating a scheduled task that runs attacker-supplied code every five minutes. The attackers also included a backup GitHub Actions workflow in case the local stealer failed to execute.

Why Developers Should Be Concerned

The incident demonstrates that removing a malicious CI workflow may not eliminate every threat. Developer tools and repository configurations can provide additional execution paths, while stolen credentials can expose cloud infrastructure, package registries, source code, and AI development services.

OpenSourceMalware identified 94 repositories containing the second-stage component, associated with 66 owners. The researchers also reported that GitHub began blocking the original malicious workflow, after which the campaign incorporated a method that did not depend on a CI runner.

How to Protect Your GitHub Repositories

Developers and security teams should:

• Review unfamiliar GitHub Actions workflows and repository changes.
• Inspect VS Code tasks.json files before opening untrusted projects.
• Revoke suspicious OAuth grants and rotate exposed access tokens from a clean device.
• Change compromised passwords and rotate credentials accessible to affected workflows.
• Review cloud, package registry, SSH, Kubernetes, and AI-provider credentials.
• Scan repositories for unexpected files and suspicious automated execution.

Conclusion

The GhostAction campaign highlights the growing risks of software supply-chain attacks against developers. Treat unfamiliar repositories, automatic editor tasks, and unexpected security alerts with caution, and rotate potentially exposed credentials promptly.

Follow CyberExy — Secure Tomorrow for cybersecurity news, threat intelligence, and practical security guidance.

Source: OpenSourceMalware, reporting on the GhostAction campaign and its fake-font credential stealer.