94 compromised repositories now host a second-stage payload that persists on developer machines and collects secrets, OpenSourceMalware has reported — a striking escalation in the supply‑chain assault known as GhostAction.
GhostAction's new delivery chain: phishing plus a disguised stealer
The GhostAction operator has moved beyond injecting malicious GitHub Actions workflows into repositories and is actively using social engineering to obtain repository-scoped OAuth tokens and deliver a local credential stealer. OpenSourceMalware says the attackers registered the domain "my-github[.]com" on October 9, 2026, and used it the same day in a phishing email sent from "noreply@my-github[.]com" that impersonated a GitHub security alert. The message warned of a login from Moscow, Russia, and instructed the recipient to click a link to secure their account.
That deceptive page acted as a reverse proxy, harvesting the victim's password and two‑factor authentication code, injecting JavaScript that authorized an OAuth app, and exfiltrating the resulting token to "my-github[.]com" on TCP/8443. OpenSourceMalware described the technique as device code phishing: the kit "receives a device code and user code, loads /login/device, extracts GitHub's forms from the returned HTML, and submits them automatically," researcher Paul McCarty explained. "It inserts the user code, locates an authorization form, adds authorize=1, and posts the approval through the victim's authenticated proxied session." He added: "The victim does not need to type the device code or consciously approve the OAuth application. This kit goes further by automating the user-code and authorization steps through the reverse-proxied session."
Role of the my-github[.]com domain and infrastructure
OpenSourceMalware ties "my-github[.]com" to the same IP address used for exfiltration by the original malicious workflow: 193.32.204[.]199. The domain followed a pattern — registered 17 days after "my-gitlab[.]com" — but McCarty cautioned that "current infrastructure does not directly connect it to GhostAction." He noted operational differences: "They use different registrars, registrant records, Cloudflare nameserver pairs, IP addresses, ASNs, and DNS designs, and no shared certificate or account artifact has been recovered."
The stolen repository-scoped OAuth token grants broad, reusable API access. The JavaScript used on the fake page silently authorizes a device OAuth flow with repo, workflow, and read:org scopes, which allow the attacker to read and write repositories, modify Actions workflow files under ".github/workflows/", and enumerate organization membership data. OpenSourceMalware summarized the intent: by combining repository-scale automation with targeted social engineering, the operator can reach projects, organizations, registries, and downstream users.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSecond-stage persistence: VS Code tasks.json and a fake font stealer
Beyond token theft, the campaign now installs a persistent second stage on developer machines. The attackers commit three files into compromised projects: a Visual Studio Code tasks.json configured with a "runOn: folderOpen" trigger so it runs when a project is opened in VS Code; a "public/fonts/fa-solid-400.woff2" file containing an infostealer payload; and a fallback GitHub Actions workflow that triggers if the stealer never runs.
OpenSourceMalware reports the faux font is a stealer designed to harvest AWS keys, PyPI tokens, npm tokens, Git logins, Kubernetes credentials, SSH private keys, and AI provider credentials for Anthropic Claude and Google Gemini. The font filename mirrors one used in a January 2026 campaign tracked as PolinRider. When executed by VS Code, the stealer also installs a cron job that runs attacker-supplied code every five minutes and sends harvested data over plain HTTP to the same server on port 8080.
Repositories affected and the attacker's operational posture
Investigators identified 94 repositories containing the second-stage component. Those repositories belong to 66 owners; 15 owners' repositories have since been deleted, renamed, or made private. Of the repositories that remain accessible, most appear largely abandoned: 65 of 79 had gone without a commit for more than a year, and one had been untouched for more than nine years.
OpenSourceMalware observed a timeline suggesting adaptation. "Stage 1 needs GitHub to run the workflow," the group said, noting that GitHub began preventing the malicious workflow from running on October 9. Waves on October 10 and 12 yielded no extracted secrets. "Stage 2 adds a launcher that doesn't need a runner at all, and it arrived six days after the block. We can’t say the block caused it. We can say the operator moved to a place GitHub's controls don't reach."
What open-source maintainers, security teams, and developers should do
- Open-source maintainers: revoke GitHub access and tokens from a clean device, change passwords, audit workflows and repository contents (especially any .github/workflows and public/fonts paths), and rotate every credential the workflows could reach.
- Security teams: treat tokens and OAuth approvals as reusable API credentials; search for calls to 193.32.204[.]199, and alert users who have cloned affected repositories because the stealer can persist locally via VS Code tasks.json.
- Developers: inspect cloned repositories for unexpected tasks.json triggers and unknown font files, and if infected, rotate all exposed keys after cleaning from a clean machine.
"We don't know who the operator is, but their work suggests limited experience," Jenn Gile, co‑founder of OpenSourceMalware, told The Hacker News. She noted operational errors in the stealer's filters and that "a single IP handles exfiltration, phishing, and noisy internet scanning. That last mistake is why searching for the IP still finds infections."
The GhostAction story is, for now, a study in rapid iteration: when GitHub's controls blunted one technique, the operator combined social engineering and a local persistence mechanism that bypasses the need for a runner. The key unanswered operational question is whether the apparent misconfigurations that reveal the campaign — a single exfiltration IP, reused nameserver patterns — will allow defenders to cut off the next variation before it establishes a broader foothold.
https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
