GhostAction Fake Font Stealer: How 94 GitHub Repos Got Hit

The GhostAction crew has stopped only poisoning GitHub workflows and started hiding a credential stealer inside a file that pretends to be a font. Researchers have found it in 94 GitHub repositories, rigged to run when a developer opens the project in VS Code.

Key takeaways

• GhostAction, a supply chain campaign first exposed in September 2025, now phishes developers with a fake GitHub security alert.
• Compromised repos receive a VS Code task, a fake .woff2 font that is really a stealer, and a backup GitHub Actions workflow.
• 94 repositories across 66 owners carry the second-stage payload, and most of them had sat untouched for more than a year.
• The stealer goes after AWS keys, npm and PyPI tokens, SSH keys, Kubernetes credentials and AI provider API keys.
• The attackers changed tactics after GitHub started blocking their malicious workflow on 9 October 2026.

What is GhostAction, and why is it back?

GhostAction first surfaced in September 2025. GitGuardian reported that attackers had hijacked 327 GitHub accounts and pushed a fake security workflow into 817 repositories. That workflow sent 3,325 secrets, including PyPI, npm, DockerHub and AWS credentials, to a server the attackers controlled.

On 8 October 2026 it returned at a much larger scale. StepSecurity documented two maintainer accounts pushing a workflow called “Add security audit workflow” into 345 repositories within minutes. The new version also searched each repo’s full git history, so secrets that had been deleted years earlier were exposed too. GitGuardian later counted about 1,900 compromised accounts and more than 30,000 targeted repositories, as The Hacker News reported on 15 October 2026.

GitHub began stopping the malicious workflow from running on 9 October. Further waves on 10 and 12 October extracted nothing, so the operators went looking for another way in.

How does the GhostAction fake font stealer work?

The latest stage, detailed by OpenSourceMalware and reported by The Hacker News on 19 October 2026, has two parts.

Part one is phishing. The domain my-github[.]com was registered on 9 October 2026 and pointed at 193.32.204[.]199, the same IP that had received secrets from the malicious workflow. The same day it sent emails posing as a GitHub alert about a sign-in from Moscow. The fake login page worked as a reverse proxy, meaning it passed traffic through to the real GitHub while capturing passwords and two-factor codes along the way.

The page also ran JavaScript that silently approved a GitHub OAuth “device flow” with the repo, workflow and read:org scopes. Device flow is the same mechanism you use to sign in to a smart TV by typing a short code on your phone. In this case the attacker’s script entered that code for you, which gave them a token that could edit workflows and read organization data.

Part two is persistence. Compromised repositories received three new files:

• A VS Code tasks.json using "runOn": "folderOpen", so it runs when the project folder opens.
• public/fonts/fa-solid-400.woff2, which looks like an ordinary icon font but is actually the stealer.
• A backup GitHub Actions workflow, with names like lint.yml, ci-check.yml or audit.yml, that fires if the stealer never runs.

Researchers noted that the font filename matches one used in PolinRider, a North Korea-linked campaign from January 2026 that also hid loaders in fake fonts and triggered them through VS Code tasks. A shared filename does not prove the two campaigns are connected.

What does the stealer take?

Target	Why attackers want it
AWS access keys	Direct access to cloud infrastructure and billing
npm and PyPI tokens	Publishing poisoned versions of popular packages
Git credentials and SSH private keys	Moving on to more repositories and servers
Kubernetes credentials	Control over production clusters
Anthropic Claude and Google Gemini API keys	Usage that can be resold or abused on the victim’s bill

It also installs a cron job, a scheduled task on Linux and macOS, that runs attacker code every five minutes. Stolen data goes out over plain HTTP on port 8080 to the same server.

Who is actually at risk?

The researchers found 94 repositories, belonging to 66 owners, that carry the second-stage files. Fifteen have since been deleted, renamed or made private. Of the 79 still reachable, 65 had no commits in more than a year, and one had not been touched in over nine years.

Opinion: the abandoned repos are the point. A dormant project is like an empty house with the key under the mat, because nobody is watching the commit log. The people most at risk are not the absent owners but anyone who clones the repo later and opens it in their editor.

The operation is also sloppy in places. Researchers found that the stealer’s environment-variable filter misses most API keys and its home-directory search can time out and throw away its results. Because one IP handles exfiltration, phishing and scanning, searching for that address still turns up infected repositories.

How to check if GhostAction reached you

1. Search your repositories for .vscode/tasks.json files containing folderOpen, and for unexpected .woff2 files under public/fonts.
2. Review .github/workflows on every branch for files you did not write.
3. Run crontab -l on any machine that opened a suspect repo.
4. From a clean device, revoke GitHub sessions, personal access tokens and authorized OAuth apps, then change your password.
5. Rotate every credential the workflows or the machine could reach, including AI provider keys.
6. Require approval for workflow runs, keep VS Code Workspace Trust enabled, and block 193.32.204[.]199 at your egress firewall.
7. If you maintain an affected repo, tell people who cloned it.

What happens next

The second stage showed up about six days after GitHub’s block. The researchers are careful to say the block may not have caused the change. The operator may simply have switched to a method GitHub’s controls do not cover yet. Expect that cycle to continue, with each new defence followed by a new delivery trick.

A lookalike domain, my-gitlab[.]com, was registered 17 days before the GitHub one. No one has confirmed it belongs to the same operator, but GitLab users should watch for similar alerts. GitGuardian also found that some October victims had been hit in earlier waves, which suggests the campaign keeps working because old secrets never get rotated.

FAQ

Is the fake font file dangerous if I only clone the repo?

Cloning alone does not run it. The risk starts when you open the folder in VS Code and the folderOpen task runs, or when the backup workflow runs in CI.

Does two-factor authentication stop this phishing?

Not when you enter codes into the fake page, because the reverse proxy relays them in real time. Phishing-resistant passkeys or hardware keys tied to github.com are much harder to proxy.

Is GhostAction linked to North Korea?

Not proven. The font filename matches one used in the North Korea-linked PolinRider campaign, but researchers have not attributed GhostAction to any state actor.

Your next step: spend ten minutes searching your own repositories for unexpected tasks.json files and workflows, then rotate any key you cannot account for.