GhostAction plants VS Code credential stealer in 94 GitHub repositories
The GhostAction supply-chain campaign has expanded from malicious GitHub Actions workflows into phishing and a developer-machine credential stealer. OpenSourceMalware identified a second-stage component in 94 compromised GitHub repositories belonging to 66 owners. The attackers used it alongside a fake GitHub security alert and a payload disguised as a font file.
The phishing infrastructure included the domain my-github[.]com, registered on October 9, 2026 and pointed at 193.32.204[.]199. OpenSourceMalware said the IP address was also used as an exfiltration endpoint for data collected by the malicious workflow. A similarly named my-gitlab[.]com domain remains only a potential investigative pivot: researcher Paul McCarty said the available infrastructure did not directly connect it to GhostAction.
Phishing page captures access and approves OAuth permissions
On the day the domain was registered, an open-source maintainer received a purported GitHub security alert from noreply@my-github[.]com. It warned of a login from Moscow and directed the recipient to secure the account. The fraudulent page operated as a reverse proxy, allowing it to harvest the victim's password and two-factor authentication code.
Its JavaScript also automated a GitHub OAuth device flow. The code obtained a device code and user code, loaded the device-login page, extracted and submitted forms through the authenticated proxied session, and added authorization without requiring the victim to enter the device code or consciously approve the application. The resulting scopes—repo, workflow, and read:org—could provide access to read and write repositories, alter Actions workflow files, and view organization information.
A repository-scoped OAuth token gives the operator a reusable API credential. OpenSourceMalware said those permissions align with GhostAction's ability to enumerate repositories and place malicious files under .github/workflows/.
Font-named payload persists beyond the workflow
The second stage commits three files to a repository: a VS Code tasks.json file, a file named public/fonts/fa-solid-400.woff2, and another GitHub Actions workflow. The VS Code task uses the runOn: folderOpen trigger, causing execution when a developer opens the folder in VS Code.
Despite its font extension, fa-solid-400.woff2 contains a stealer designed to collect AWS keys, PyPI tokens, npm tokens, Git logins, Kubernetes cluster credentials, SSH private keys, and credentials for Anthropic Claude and Google Gemini. OpenSourceMalware noted that the filename was also used in North Korea's PolinRider campaign in January 2026. The stealer sends collected data over plain HTTP on port 8080 and installs a cron job to run attacker-supplied code every five minutes.
The fallback workflow activates if the infostealer does not run. It resembles the original GhostAction workflow, adds credential formats to search for, and can upload results to a secret GitHub gist when an HTTP POST fails. Observed workflow names include lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml, and cache-cleanup.yml.
Business response
GitHub began preventing the original malicious workflow from running on October 9, and OpenSourceMalware reported that the October 10 and 12 waves extracted no secrets. The VS Code launcher arrived six days after the block and does not depend on a runner. Of the 94 repositories, 15 had been deleted, renamed, or made private; 65 of the 79 still accessible repositories had not received a commit for more than a year.
Teams that may have interacted with affected repositories should revoke GitHub access and tokens from a clean device, change passwords, audit repositories, rotate every credential reachable by the workflows, and notify users who cloned the code. The practical priority is to treat an apparently inactive repository and a familiar asset filename as potential delivery paths for developer credential theft.