GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
GhostAction attackers have escalated from poisoning GitHub Actions to planting credential stealers disguised as font files across 94 repositories—an evolution that directly threatens organisations relying on open-source supply chains.
Summary written by editorial AI · Source link below
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Editorial Analysis
The campaign's expansion from workflow poisoning to developer-targeted social engineering with stealer payloads shows supply-chain attackers are diversifying tactics faster than most dependency governance programmes can adapt.
Audit your GitHub Actions for pinning by commit hash, scan SBOMs against the list of compromised repositories, and alert developers to the phishing vector.
A supply-chain attack campaign has planted credential-stealing malware in nearly 100 GitHub repositories used by developers worldwide.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d