GhostAction Crew Uses VS Code Tasks to Exfiltrate Dev Credentials via Fake Fonts
Attackers are hiding Node.js stealers in font files within GitHub repos, using Visual Studio Code tasks to harvest keys and tokens from developer machines.
Key points
- Researchers identified 94 compromised repositories belonging to 66 owners containing the new malware stage.
- The payload disguises malicious JavaScript as a font file and executes via Visual Studio Code workspace tasks.
- The stealer collects SSH keys, cloud credentials, and API tokens, then exfiltrates them to a remote server.
GhostAction threat actors have introduced a new credential theft method that targets developers using Visual Studio Code, according to a report by GBHackers. This second-stage attack disguises malicious Node.js code as a font file and leverages IDE task configurations to execute the payload when users open affected projects.
Security researcher Jenn Gile identified 94 compromised GitHub repositories across 66 unique owners. Gile confirmed the presence of the malicious payload in 79 of these repositories, while the remaining 15 were inaccessible for analysis. The investigation began after Jamf Threat Labs researcher Thijs Xhaflaire spotted the cluster while hunting for PolinRider infections, linking it to the broader GhostAction campaign.
Mechanism and Execution
The attackers place a launcher script in the .vscode/tasks.json file and store the actual payload at public/fonts/fa-solid-400.woff2. Although the filename mimics a legitimate Font Awesome resource, the file contains 38 lines of unobfuscated Node.js code. A task labeled eslint-check invokes Node.js against this disguised script.
The configuration uses the runOn: folderOpen trigger to request execution when developers open the project folder. Presentation settings are adjusted to suppress terminal visibility, hiding the activity from the user. Execution requires the workspace to be trusted and automatic tasks to be permitted. Simply cloning or opening the repository does not guarantee the malware runs, as these conditions must be met.
Data Collection and Persistence
Once active, the stealer harvests usernames, hostnames, specific environment variables, and credential files linked to AWS, npm, PyPI, Git, Kubernetes, Claude, and Gemini services. It reads RSA and Ed25519 SSH private keys entirely but limits reads from eight other credential files to the first 3,000 characters.
A recursive search scans the home directory for patterns matching AWS, Anthropic, GitHub, npm, and PyPI tokens. The collected data is sent via an HTTP POST request on port 8080. Gile linked the infrastructure to the IP address 193[.]32[.]204[.]199. On systems with cron support, the payload installs a scheduled command running every five minutes to retrieve further scripts from a hostname-specific server path.
Who is Affected
The campaign extends an operation previously focused on malicious GitHub Actions workflows that steal repository secrets and credentials exposed in Git history. As Threat Times reported on October 18, 2026, hackers stole data on roughly 1,500 people via GitHub repositories. This new variant specifically targets developer workstations rather than just the repository contents.
The malware includes a marker #ghc2 and removes existing matching entries before adding new ones. Deleting the malicious repository files does not remove the cron-based foothold if it has already been installed. Gile has not retrieved the subsequent server-delivered payload, leaving its specific functionality unresolved.
What should you do?
No patch or fix has been confirmed yet for this specific campaign. Organizations should treat untrusted workspace configurations with caution. Developers must verify the integrity of local files and monitor for unauthorized scheduled tasks.
What to do and how to stay safe: GhostAction
- Audit Visual Studio Code workspace trust settings and disable automatic task execution for untrusted folders to prevent silent payload runs.
- Scan repositories for unexpected files in .vscode/tasks.json or font directories that contain executable code rather than binary font data.
- Check system cron jobs and scheduled tasks for entries containing the #ghc2 marker or commands piping remote scripts into Bash shells.
- Rotate all exposed credentials, including SSH keys, API tokens, and cloud service passwords, if a developer machine may have accessed a compromised repository.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the GhostAction malware execute on a developer's machine?
It uses a Visual Studio Code task configuration labeled eslint-check to run a Node.js script disguised as a font file when the workspace is opened.
What types of credentials does the malware steal?
The stealer collects SSH keys, environment variables, and credentials for AWS, npm, PyPI, Git, Kubernetes, Claude, and Gemini, as well as various API tokens.
Does deleting the infected repository files remove the malware?
No, deleting the repository files leaves the foothold intact if the malware has already installed a cron job or scheduled task to maintain persistence.
