The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running.
According to the threat intelligence platform, the threat actor registered the domain "my-github[.]com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.
The domain was registered on October 9, 2026, 17 days after "my-gitlab[.]com" was registered. It's unclear if the latter code-hosting-themed domain is operated by the same threat actor.
"It follows the same my-<code-host>.com naming pattern, making it a useful pivot, but current infrastructure does not directly connect it to GhostAction," security researcher Paul McCarty said. "They use different registrars, registrant records, Cloudflare nameserver pairs, IP addresses, ASNs, and DNS designs, and no shared certificate or account artifact has been recovered."
Since then, the "my-github[.]com" domain has been used in a phishing email impersonating a GitHub security alert to target an open-source maintainer the same day it was registered. The message, sent from "noreply@my-github[.]com," warned of a new login to their GitHub account from Moscow, Russia, and instructed them to click on a link to secure their account.
The deceptive page, per OpenSourceMalware, is said to have acted as a reverse proxy, harvesting the victim's password and two-factor authentication (2FA) code, and injected JavaScript that authorized an OAuth app with permissions to modify their workflows so as to facilitate a GhostAction-style attack.
The fake login page also includes JavaScript to silently authorize a GitHub OAuth device flow with repo, workflow, and read:org scopes, granting it broad permissions to read/write repositories, modify Actions workflow files, and gain visibility into organization membership and related organizational data.
The idea is the same as device code phishing, where the end goal is to obtain an access token from GitHub and exfiltrate it to "my-github[.]com" on TCP/8443.
"The script receives a device code and user code, loads /login/device, extracts GitHub's forms from the returned HTML, and submits them automatically," McCarty explained. "It inserts the user code, locates an authorization form, adds authorize=1, and posts the approval through the victim's authenticated proxied session."
"The victim does not need to type the device code or consciously approve the OAuth application. This kit goes further by automating the user-code and authorization steps through the reverse-proxied session."
By stealing a repository-scoped OAuth token, it gives the attacker a reusable API credential. Furthermore, the permissions granted through the stealthy OAuth authorization are consistent with GhostAction's ability to enumerate repositories and inject malicious workflow files under ".github/workflows/."
"The actor can now combine repository-scale automation with individual social engineering against people whose accounts provide access to projects, organizations, registries, and downstream users," OpenSourceMalware said.
To make matters worse, the campaign has also been observed incorporating a second-stage component that persists on developer machines even after the malicious workflow has been removed.
Specifically, the approach takes a leaf out of North Korea's playbook by committing three different files -
- A Microsoft Visual Studio Code (VS Code) tasks.json file with a "runOn: folderOpen" trigger that causes it to run automatically when the folder is opened in the application.
- A "public/fonts/fa-solid-400.woff2" file that contains a stealer payload designed to harvest AWS keys, PyPI tokens, npm tokens, Git logins, Kubernetes cluster credentials, SSH private keys, and AI provider credentials for Anthropic Claude and Google Gemini. The font file name is the same as one used in North Korea's PolinRider campaign from January 2026.
- A second GitHub Actions workflow that's activated if the infostealer never runs.
This causes VS Code to auto-run the credential stealer, which, besides collecting data, installs a cron job that runs attacker-supplied code every five minutes. The collected data is sent to the same server over plain HTTP on port 8080. A total of 94 compromised repositories with the second-stage component have been identified.
As for the second CI workflow, it's the same as the original malicious workflow, but with added credential formats to look for and a fallback that uploads findings to a secret GitHub gist if the POST fails. The second workflow goes by the following names -
- lint.yml
- ci-check.yml
- build-check.yml
- repo-health.yml
- audit.yml
- code-review.yml
- test-suite.yml
- cache-cleanup.yml
OpenSourceMalware said the 94 repositories belong to 66 owners, out of which 15 have since been deleted, renamed, or made private. Of the still accessible repositories, most of them appear to have been largely abandoned, with one of them left untouched for more than nine years. Sixty-five of the 79 went without a commit for more than a year.
"Stage 1 needs GitHub to run the workflow," OpenSourceMalware said. "On October 9, GitHub started preventing the malicious workflow from running, and the waves on October 10 and 12 extracted no secrets. Stage 2 adds a launcher that doesn't need a runner at all, and it arrived six days after the block. We can’t say the block caused it. We can say the operator moved to a place GitHub's controls don't reach."
To mitigate the threat, developers should revoke GitHub access and tokens from a clean device, change their passwords, audit their repositories, rotate every credential the workflows can reach, and alert users who have cloned the repositories.
"We don't know who the operator is, but their work suggests limited experience," Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News. "The stealer's environment-variable filter misses most API keys, its home-directory search can time out and discard its own results, and a single IP handles exfiltration, phishing, and noisy internet scanning. That last mistake is why searching for the IP still finds infections."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.