GhostAction Actors Phish Developers with Fake Font Stealer and GitHub Impersonation
Threat actors behind the GhostAction campaign now use fake font files and phishing emails to steal credentials and OAuth tokens from open-source maintainers.
Key points
- Attackers added credential stealer malware disguised as a font file to 94 GitHub repositories.
- A new phishing campaign uses the my-github.com domain to harvest passwords and OAuth tokens.
- The malicious OAuth app requests broad permissions including workflow modification and repo access.
Threat actors responsible for the GhostAction supply chain attack have expanded their operations to include phishing open-source developers and delivering credential-stealing malware disguised as a font file. This latest evolution, detailed by OpenSourceMalware, indicates that the group is refining its tactics in response to defensive measures implemented by GitHub to block malicious workflows.
The attackers previously focused on injecting malicious GitHub Actions workflows into compromised projects. According to OpenSourceMalware, they have now planted a stealer malware within a fake font file across 94 GitHub repositories. This shift suggests an attempt to bypass existing security controls that target automated workflow executions, moving toward direct credential theft from developers who interact with the compromised code.
Infrastructure and Phishing Tactics
The threat actor registered the domain my-github.com on October 9, 2026, and pointed it to the IP address 193.32.204.199. This IP address serves as an exfiltration endpoint for data harvested from the malicious workflows. The domain was registered 17 days after my-gitlab.com, though it remains unclear if the same actor operates both. Security researcher Paul McCarty noted that while the naming pattern is similar, current infrastructure does not directly connect my-gitlab.com to GhostAction due to differences in registrars, DNS designs, and IP addresses.
On the day of registration, the my-github.com domain was used in a phishing email impersonating a GitHub security alert. The message, sent from [email protected], warned an open-source maintainer of a new login attempt from Moscow, Russia. The email instructed the recipient to click a link to secure their account, leading to a deceptive page that acted as a reverse proxy to harvest passwords and two-factor authentication codes.
Access and Permissions
The fake login page injected JavaScript to silently authorize a GitHub OAuth app with broad permissions. According to OpenSourceMalware, the app requested repo, workflow, and read:org scopes. These permissions allow the attacker to read and write repositories, modify Actions workflow files, and gain visibility into organization membership. This technique mirrors device code phishing, aiming to obtain an access token from GitHub and exfiltrate it to my-github.com on TCP port 8443.
This approach facilitates a GhostAction-style attack by granting the malware the ability to modify workflows directly through the stolen token. The combination of credential theft and OAuth token acquisition provides the attackers with persistent access to the victim's repositories and organizational data, bypassing standard authentication checks that rely on passwords alone.
What should you do?
Organizations and developers should monitor for unauthorized OAuth applications with broad permissions in their GitHub accounts. Reviewing recent login activity for anomalies, such as logins from unexpected locations like Moscow, can help identify compromised credentials. Teams should also audit repositories for unexpected files, such as font files, that may contain hidden malware.
Background: OAuth
The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.
Read the full guide: Difference Between OAuth and API Key and How to Choose
What to do and how to stay safe
- Audit GitHub accounts for unauthorized OAuth applications with repo or workflow permissions.
- Monitor login notifications for suspicious locations and immediately rotate credentials if detected.
- Inspect repositories for unexpected file types like fonts that may harbor malicious payloads.
- Enable enhanced security alerts for workflow modifications and unusual API activity.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many repositories were affected by the fake font malware?
The stealer malware disguised as a font file
