Attackers have planted a credential stealer disguised as a font file in 94 GitHub repositories belonging to 66 owners, in a follow-up to a campaign known as GhostAction. Fifteen of the repositories have since been deleted, renamed or made private, and of the 79 still accessible, 65 had no commits in over a year.
The planted files include a fake font at a path normally used for icon fonts, a VS Code tasks file set to run automatically when a developer opens the folder and launch the stealer, and a second GitHub Actions workflow that runs if the stealer never executes. The committed files let the malware run on a developer's own machine without a build server.
What it steals
The stealer goes after AWS keys, package-registry tokens, Git logins, Kubernetes cluster credentials, SSH private keys and API credentials for AI services. It installs a cron job that runs attacker-supplied code every five minutes and sends data to the same server over plain HTTP. The second workflow adds more credential formats to search for and falls back to uploading its findings to a secret gist if the direct upload fails.
How it spread
The first stage of the campaign injected malicious workflows into projects. GitHub began blocking it on 9 October, and researchers say attack waves on 10 and 12 October extracted no secrets. A domain registered on 9 October sent a fake security alert about a login from Moscow and acted as a reverse proxy to capture passwords and two-factor codes, then silently authorised an OAuth device flow with broad repository and workflow permissions and sent the resulting token to the attackers' server.
Researchers say the infrastructure does not directly tie this phishing kit to the original campaign, though the domain follows a similar naming pattern, and the file name matches one used in a January 2026 campaign linked to North Korea, an overlap on a single detail. One researcher said they do not know who the operator is but that the work suggests limited experience. They cannot say whether GitHub's block caused the shift to the second stage. Whether a related domain registered 17 days earlier belongs to the same actor, and whether any phishing victim was actually compromised, are not established.
Affected developers are advised to revoke GitHub access and tokens from a clean device, change passwords, audit repositories, rotate every credential the workflows could reach, and alert anyone who cloned the repositories.
