Threats · 5h ago
OpenSourceMalware reports GhostAction has shifted to GitHub-themed phishing and a Visual Studio Code-triggered fake-font stealer, with 94 repositories carrying the second stage. The change followed GitHub measures that disrupted the attackers’ original malicious Actions workflow.
A fake security alert sends a maintainer to a lookalike sign-in page that relays the password and two-factor code, then quietly approves a GitHub OAuth app through the authenticated session. The resulting access token can read and change repositories, alter Actions workflows, and reveal organization membership—giving attackers a way to restore workflow control through the maintainer.
If a maintainer’s account spans repositories or an organization, the exposure follows that account’s OAuth permissions, not just the 94 repositories carrying the stealer stage. Blocking the original workflow leaves this separate route to broader repository access.
1 source covering this story
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
GhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.
Part of the PlainSec briefing for 2026-10-19