Affected Systems

94 GitHub repositories across 66 owners compromised. Targets open-source developers using GitHub Actions, VS Code, and OAuth device flows. Malware disguised as font file (fa-solid-400.woff2) steals AWS keys, PyPI/npm tokens, Git credentials, Kubernetes configs, SSH keys, and AI provider credentials (Anthropic Claude, Google Gemini).

Exploitation Status

Active exploitation confirmed. Attackers evolved tactics after GitHub blocked malicious workflows on October 9, 2026. Phishing infrastructure (my-github[.]com) registered October 9, 2026, with active credential harvesting via reverse proxy and automated OAuth authorization. Second-stage persistence mechanism deployed to developer workstations.

Business Impact

Developers who clone or open compromised repositories in VS Code automatically execute credential stealer via tasks.json with folderOpen trigger. Stolen OAuth tokens grant repo/workflow/read:org scopes, enabling attackers to modify workflows, enumerate repositories, and pivot to downstream supply chain targets. Persistence via cron job executes attacker code every 5 minutes. Exfiltration to 193.32.204[.]199 on ports 8080 and 8443. Most affected repos abandoned (65 of 79 had no commits for over a year), increasing risk of undetected compromise.

Urgency

🔴 Immediate

Recommended Actions

  • ["Block network traffic to 193.32.204[.]199 and domain my-github[.]com at perimeter and endpoint firewalls"]
  • ["Audit GitHub OAuth applications for all developer accounts; revoke any with repo, workflow, or read:org scopes granted on or after October 9, 2026"]
  • ["Search developer workstations for VS Code tasks.json files with runOn:folderOpen triggers and font files named fa-solid-400.woff2 in public/fonts/ directories"]
  • ["Review GitHub Actions workflows for unauthorized files: lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml, cache-cleanup.yml in .github/workflows/ directories"]
  • ["Rotate all credentials accessible from developer machines: AWS keys, PyPI/npm tokens, SSH private keys, Kubernetes configs, and AI provider API keys for Anthropic and Google Gemini"]
  • ["Check cron jobs on developer Linux/macOS systems for entries executing every 5 minutes pointing to external IPs"]

---

# Threat Actor Context

Actor Profile

GhostAction is a threat actor conducting sophisticated supply chain attacks targeting the open-source software ecosystem. The actor demonstrates advanced capabilities in compromising GitHub repositories and phishing developers through social engineering. Their motivation appears focused on credential harvesting and establishing persistent access to software development infrastructure. GhostAction shows operational agility by rapidly adapting tactics in response to defensive measures, evolving from workflow injection to multi-stage persistence mechanisms within six days of GitHub implementing blocks. The actor operates infrastructure including the domain my-github[.]com (registered October 9, 2026) pointed at 193.32.204[.]199 for data exfiltration.

TTPs (Tactics, Techniques, Procedures)

GhostAction employs multi-stage supply chain compromise techniques. Initial access is achieved through credential phishing using fake GitHub security alerts sent from spoofed domains (my-github[.]com), combined with reverse proxy pages that harvest passwords and 2FA codes. The actor leverages OAuth device flow authorization to obtain repository-scoped tokens with repo, workflow, and read:org permissions. Persistence is established through malicious GitHub Actions workflows injected into .github/workflows/ directories, VS Code tasks.json files with folderOpen triggers, and cron jobs executing every five minutes. Credential access involves a stealer payload disguised as a font file (fa-solid-400.woff2) targeting AWS keys, PyPI tokens, npm tokens, Git credentials, Kubernetes configs, SSH keys, and AI provider credentials (Anthropic Claude, Google Gemini). Exfiltration occurs via HTTP POST to 193.32.204[.]199:8080 and fallback uploads to secret GitHub gists. The campaign demonstrates defense evasion through automated OAuth authorization via injected JavaScript and multi-stage fallback mechanisms.

Targets & Patterns

GhostAction specifically targets open-source software developers and maintainers with access to GitHub repositories. The campaign has compromised 94 repositories belonging to 66 distinct owners, predominantly targeting abandoned or low-activity projects (65 of 79 accessible repos had no commits for over a year, with one dormant for nine years). This targeting pattern suggests the actor exploits unmaintained projects with weaker security posture as entry points into the software supply chain. The focus on developers provides access to high-value credentials including package registry tokens (PyPI, npm), cloud infrastructure keys (AWS, Kubernetes), and organizational data through GitHub OAuth scopes. By compromising developer environments, GhostAction gains potential access to downstream users, private repositories, organizational memberships, and software distribution channels, enabling broad supply chain impact beyond the initial compromise.

Historical Context

The GhostAction campaign represents an evolution from earlier GitHub Actions workflow injection attacks. The actor registered my-gitlab[.]com on September 22, 2026, followed by my-github[.]com on October 9, 2026, though infrastructure analysis has not definitively linked these domains to the same operator. On October 9, 2026, GitHub implemented blocks preventing the original malicious workflows from running, which stopped secret exfiltration in waves on October 10 and 12. Six days after this defensive action, GhostAction deployed Stage 2 tactics incorporating VS Code persistence and font-disguised stealers. The use of the fa-solid-400.woff2 filename mirrors techniques from North Korea's Fake Font/PolinRider campaign from January 2026, suggesting possible tactical borrowing from DPRK-nexus operations. The rapid tactical adaptation (within six days of blocking) demonstrates active campaign management and operational resilience.

Defensive Recommendations

  • Monitor for unauthorized GitHub OAuth applications with repo, workflow, and read:org scopes; audit existing OAuth authorizations and revoke suspicious tokens with broad repository permissions
  • Implement detection for VS Code tasks.json files containing runOn: folderOpen triggers in repository root directories; alert on unexpected .vscode configuration changes
  • Block outbound connections to 193.32.204[.]199 on ports 8080 and 8443; monitor DNS queries for my-github[.]com and similar code-hosting-themed typosquat domains
  • Scan for suspicious font files (particularly .woff2 extensions) in non-standard locations like public/fonts/ directories; validate font files contain legitimate font data rather than executable payloads
  • Audit GitHub Actions workflows for unexpected files matching patterns: lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml, cache-cleanup.yml in .github/workflows/ directories
  • Enable GitHub Advanced Security features to detect secret scanning bypass attempts; monitor for workflows that POST credentials to external endpoints on non-standard ports
  • Inspect cron job modifications on developer workstations; alert on new cron entries executing scripts at frequent intervals (e.g., every 5 minutes) from repository directories