GhostAction attackers have shifted from malicious GitHub Actions workflows to a fake font file that launches a credential stealer when a developer opens an infected project in Visual Studio Code. Researchers at OpenSourceMalware identified the second-stage malware in 94 repositories belonging to 66 owners, making the campaign a direct threat to developer workstations as well as CI/CD infrastructure. The Hacker News reported the findings, which were published October 19. [4]
The attack uses a .vscode/tasks.json configuration with "runOn": "folderOpen" to start the payload when the repository is opened. Microsoft’s Visual Studio Code documentation confirms that this setting runs a task when its containing folder opens, although automatic tasks are restricted in untrusted workspaces. [28] The malware is hidden in public/fonts/fa-solid-400.woff2, a filename that appears to reference a normal Font Awesome asset but instead contains executable code. It also installs a cron job that runs attacker-supplied code every five minutes.
Researchers said the stealer searches for AWS keys, PyPI and npm tokens, Git credentials, Kubernetes credentials, SSH private keys, and credentials for Anthropic Claude and Google Gemini. It sends collected data over plain HTTP to infrastructure associated with 193.32.204[.]199, using port 8080. The repository package also contains a fallback GitHub Actions workflow that attempts to collect credentials if the local infostealer does not run; filenames observed in the campaign include lint.yml, ci-check.yml, audit.yml and code-review.yml.
The campaign’s first stage relied on phishing and stolen GitHub access. A site at my-github[.]com reportedly impersonated a GitHub security alert, proxied a login and two-factor authentication flow, and authorized an OAuth application with repo, workflow and read:org scopes. Those permissions can allow an attacker to modify repositories and inject workflows. Researchers said GitHub began blocking the original malicious workflow on October 9; the font-based stage appeared six days later, though they stopped short of proving that the platform change directly caused the pivot.
The scope is significant but the available evidence does not establish a new CVE, a CVSS score, or a confirmed nation-state operator. OpenSourceMalware linked the font filename to a North Korean PolinRider campaign that used it in January, but the researchers did not establish that the same actor was responsible. Most of the 79 still-accessible repositories appeared inactive, with 65 lacking a commit for more than a year; 15 of the 94 had been deleted, renamed or made private.
Maintainers should inspect repositories for unexpected tasks.json files, automatic folder-open tasks, the fake font filename and newly added workflow files, while treating code from dormant projects as untrusted. Teams that opened affected repositories should assume local and repository credentials may have been exposed, revoke and rotate them, review GitHub OAuth grants and audit repository history and Actions logs. GitHub’s security guidance recommends auditing how secrets are handled and using minimally scoped credentials; those controls are especially important because a local stealer can bypass protections focused only on GitHub-hosted runners. [22]
References
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
- docs.github.com · actions · security-for-githubSecure use reference – GitHub Docs
- Tasks
