GhostAction phish completes a GitHub device flow, then hides a stealer in a font file
OpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, workflow and read:org scopes. A second stage planted a credential stealer named fa-solid-400.woff2 in 94 repositories.
Paul McCarty of OpenSourceMalware reported on October 19 that the infrastructure behind the GhostAction GitHub campaign has added phishing and a second-stage stealer. A domain registered October 9, my-github[.]com, sent a fake GitHub alert about a Moscow login to an open-source maintainer. The page reverse-proxied the victim's password and 2FA code, and injected JavaScript completed a GitHub OAuth device flow granting repo, workflow and read:org scopes. McCarty says the domain is not directly tied to GhostAction, though it points at the same IP that receives stolen data. In 94 repositories across 66 owners, the operator also committed a VS Code tasks.json that runs on folder open, a stealer named public/fonts/fa-solid-400.woff2, and a backup Actions workflow. It targets AWS, npm, PyPI, Kubernetes, SSH and AI provider keys. GitHub began blocking the original workflow on October 9.
Why it matters
The phish did not stop at a password and code. It turned a one-time login into a long-lived OAuth grant, which survives a password reset. This is device code phishing combined with an adversary-in-the-middle proxy, and only phishing-resistant MFA such as a passkey stops the proxy half.
Maintainers should review Settings, Applications, Authorized OAuth Apps for grants they did not make, revoke tokens from a clean device, and move GitHub sign-in to a passkey or security key. Search repositories for the font path and unexpected tasks.json files, and keep VS Code workspace trust on so opening a cloned folder does not run tasks. Rotate everything the workflows could read. Our October 15 GhostAction post covers the earlier wave.
Source: The Hacker News
Related on Start with Identity
- BlogGheist turns stolen GitHub tokens into secret dumps through Actions logs
Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-syn
- BlogCrowdSec kept a departing engineer's GitHub access open, and lost 170 private repositories through it
An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti