The GhostAction operator has expanded its repository-compromise campaign with a phishing kit and a persistent credential stealer disguised as a web font, according to The Hacker News’ account of findings from OpenSourceMalware.
Researchers identified the second-stage component in 94 repositories belonging to 66 owners. Those figures describe repositories and owners, not confirmed victims or stolen credentials. Of the 94 repositories, 15 had been deleted, renamed or made private, leaving 79 accessible when counted.
The new approach follows GhostAction’s earlier use of malicious GitHub Actions workflows to search projects for secrets. OpenSourceMalware reported that GitHub began preventing that workflow from running on October 9, 2026. The researchers did not claim the block caused the subsequent change, but assessed that the operator shifted execution into areas beyond those workflow controls.
Phishing captures credentials and authorizes an OAuth device flow
The phishing infrastructure centers on my-github[.]com, registered on October 9, 2026 and resolving to 193.32.204[.]199. The same IP address was reportedly used as the exfiltration endpoint for GhostAction’s first-stage workflow.
On October 9, an email from noreply@my-github[.]com reached an open-source maintainer. It impersonated a GitHub security notice, claimed that someone had logged in from Moscow, Russia, and directed the recipient to a link presented as a way to secure the account.
OpenSourceMalware described the phishing kit as a reverse proxy capable of intercepting both the account password and the victim’s two-factor authentication code. It also injects JavaScript into the proxied session to authorize a GitHub OAuth device flow with three scopes:
repo, providing repository access;workflow, allowing changes to GitHub Actions workflow files;read:org, exposing organization membership information.
The kit automates device-code entry and authorization rather than asking the victim to type the code or knowingly approve the application. The resulting access token is sent to my-github[.]com over TCP port 8443.
Such a token gives the operator a reusable API credential with permissions aligned to GhostAction’s observed behavior: enumerating repositories and placing malicious files under .github/workflows/.
A related domain, my-gitlab[.]com, was registered 17 days before my-github[.]com. Researcher Paul McCarty said there was no direct infrastructure link tying it to GhostAction. The domains differed in their registrars, registration records, Cloudflare nameserver pairs, IP addresses, autonomous systems and DNS configuration, with no shared certificate or account artifact recovered.
Stage 2 runs when developers open a repository
Six days after the reported workflow block, researchers observed a second stage that adds three components to compromised repositories.
The first is a Visual Studio Code tasks.json file configured with runOn: folderOpen. This causes the payload to execute automatically when the project is opened in Visual Studio Code.
The second is public/fonts/fa-solid-400.woff2. Despite the .woff2 extension and font-like path, OpenSourceMalware identified it as a credential stealer targeting:
- AWS keys;
- PyPI and npm tokens;
- Git credentials;
- Kubernetes cluster credentials;
- SSH private keys;
- Anthropic Claude and Google Gemini credentials.
After collecting data, the payload installs a cron job that runs attacker-supplied code every five minutes. Stolen material is transmitted to the same server over unencrypted HTTP on port 8080.
The font filename also appeared in the PolinRider campaign in January 2026. That overlap does not, by itself, establish that GhostAction is operated by the same actor or by North Korea.
The third component is another GitHub Actions workflow intended to provide an alternative execution route if the local stealer does not run. It retains the original workflow’s core logic, adds more credential formats and, if its HTTP POST fails, can place the findings in a secret GitHub gist.
Observed workflow filenames include:
lint.ymlci-check.ymlbuild-check.ymlrepo-health.ymlaudit.ymlcode-review.ymltest-suite.ymlcache-cleanup.yml
OpenSourceMalware also recorded first-stage workflow waves on October 10 and October 12, 2026, but reported that those waves extracted no secrets.
Many exposed repositories were inactive
Among the 79 repositories that remained accessible, 65 had received no commit for more than one year. One had been untouched for more than nine years.
Inactivity does not neutralize the malicious files. Developers or downstream users who clone an affected project and open it in Visual Studio Code could still trigger the folderOpen task. The available repository count also does not show how many people opened the projects or how many credentials were successfully collected.
OpenSourceMalware co-founder Jenn Gile said the operator remains unidentified and assessed that the implementation “suggests limited experience.” She cited an environment-variable filter that fails to capture most API keys, a home-directory search capable of timing out and discarding its results, and the use of one IP address for phishing, exfiltration and internet scanning.
Response steps for maintainers and repository users
OpenSourceMalware recommends that affected maintainers revoke GitHub access and tokens from a clean device, change passwords and inspect their repositories for unauthorized files and workflow changes.
Credentials reachable by the affected workflows should be rotated, including repository secrets and any cloud, package-registry, SSH, Kubernetes or AI-provider credentials exposed to the project environment. Maintainers should also notify people who cloned affected repositories so they can inspect their systems and rotate credentials where necessary.
Repository reviews should include .github/workflows/, Visual Studio Code task configuration, the path public/fonts/fa-solid-400.woff2, and the observed workflow filenames. Because the stealer establishes a cron job, removing malicious repository files alone may not eliminate persistence from a system where the payload has already executed.
