GhostAction shifts from blocked workflows to GitHub account theft
OpenSourceMalware reports GhostAction has shifted to GitHub-themed phishing and a Visual Studio Code-triggered fake-font stealer, with 94 repositories carrying the second stage. The change followed GitHub measures that disrupted the attackers’ original malicious Actions workflow.
A fake security alert sends a maintainer to a lookalike sign-in page that relays the password and two-factor code, then quietly approves a GitHub OAuth app through the authenticated session. The resulting access token can read and change repositories, alter Actions workflows, and reveal organization membership—giving attackers a way to restore workflow control through the maintainer.
If a maintainer’s account spans repositories or an organization, the exposure follows that account’s OAuth permissions, not just the 94 repositories carrying the stealer stage. Blocking the original workflow leaves this separate route to broader repository access.