The **GhostAction** supply chain attack has taken a concerning turn, with its operators diversifying their methods to target open-source developers. Initially known for injecting malicious GitHub Actions workflows, the attackers are now deploying advanced phishing techniques and a credential-stealing malware disguised within a fake font file. This strategic evolution, meticulously tracked by **OpenSourceMalware**, indicates a proactive response to GitHub's efforts to mitigate the original workflow-based attacks. ### New Phishing Domain and Reverse Proxy Tactics **OpenSourceMalware** reported the registration of the domain `my-github[.]com` on October 9, 2026. This domain points to `193.32.204[.]199`, the same IP address used to exfiltrate data from the initial malicious workflows. While a similar domain, `my-gitlab[.]com`, was registered earlier, security researcher **Paul McCarty** notes that direct infrastructure links to **GhostAction** are not yet established, despite the similar naming pattern. `my-github[.]com` has since been used in a targeted phishing campaign. Open-source maintainers received emails impersonating GitHub security alerts, warning of new logins from Moscow, Russia, and prompting them to click a link to secure their accounts. Upon clicking, victims were directed to a deceptive page acting as a reverse proxy. This sophisticated setup harvested passwords and **two-factor authentication (2FA)** codes. Crucially, it also injected JavaScript to silently authorize a **GitHub OAuth** app, granting broad permissions to modify workflows and facilitate further **GhostAction**-style attacks. This phishing kit further automates the **GitHub OAuth device flow**, eliminating the need for victims to manually enter device codes or consciously approve the application. As **McCarty** explains, the script extracts and submits GitHub's authorization forms automatically through the victim's authenticated, proxied session, thereby stealing a reusable **API** credential with extensive repository, workflow, and organization read permissions. ### Persistent Malware Disguised as a Font File Beyond the initial compromise, the campaign now includes a second-stage component designed for persistence on developer machines, even after malicious workflows are removed. This new approach mirrors tactics previously observed in attacks attributed to North Korean threat actors. The attackers are committing three specific files: * A **Microsoft Visual Studio Code (VS Code)** `tasks.json` file with a `runOn: folderOpen` trigger, ensuring automatic execution when the project folder is opened. * A `public/fonts/fa-solid-400.woff2` file. This is not a legitimate font but a stealer payload designed to harvest sensitive credentials, including **AWS** keys, **PyPI** tokens, **npm** tokens, Git logins, **Kubernetes** cluster credentials, **SSH** private keys, and **AI** provider credentials (for **Anthropic Claude** and **Google Gemini**). The filename is identical to one used in North Korea's **PolinRider** campaign from January 2026. * A second **GitHub Actions** workflow, activated as a fallback if the infostealer fails to run. When a developer opens the compromised project in **VS Code**, the `tasks.json` file automatically executes the credential stealer. This malware not only collects data but also installs a cron job to run attacker-supplied code every five minutes. Collected data is then exfiltrated to the same server over plain HTTP on port 8080. A total of 94 repositories have been identified with this second-stage component. The second **CI** workflow, similar to the original malicious workflow, includes additional credential formats to target and a fallback mechanism to upload findings to a secret GitHub gist if direct `POST` exfiltration fails. These workflows are named `lint.yml`, `ci-check.yml`, `build-check.yml`, `repo-health.yml`, `audit.yml`, `code-review.yml`, `test-suite.yml`, and `cache-cleanup.yml`. **OpenSourceMalware** found that the 94 compromised repositories belong to 66 owners. Many of these repositories appear to be abandoned, with 65 of 79 having no commits for over a year, making them prime targets for such persistent attacks. ### Mitigating the Threat **Jenn Gile**, co-founder of **OpenSourceMalware**, notes that despite the sophistication, the operator's work suggests limited experience, evidenced by inefficient credential filtering, potential timeouts in home-directory searches, and the use of a single IP for exfiltration, phishing, and noisy internet scanning—a mistake that aids in tracking infections. To mitigate the risk, developers are advised to: * Revoke GitHub access and tokens from a clean device. * Change their passwords. * Audit their repositories for unauthorized changes. * Rotate all credentials accessible by any potentially compromised workflows. * Alert users who have cloned the affected repositories.