OpenSourceMalware found credential stealer disguised as font in 94 GitHub repositories

OpenSourceMalware found a credential-stealing component disguised as a font file across 94 GitHub repositories in the GhostAction supply-chain campaign, with the font-based stage appearing around October 15, 2026.

OpenSourceMalware investigated the cluster after researcher Thijs Xhaflaire of Jamf Threat Labs identified suspicious repositories while hunting PolinRider infections. Cyber Security News said OpenSourceMalware researchers identified the latest GhostAction stage while looking into a malicious PyPI package called claudecord and helping its maintainer respond. Security Arsenal described the campaign as confirmed active, in-the-wild exploitation, not theoretical, with repositories compromised and credentials stolen.

A phishing email from noreply@my-github[.]com impersonated a GitHub security alert on October 9, 2026 and warned an open-source maintainer of a suspicious new login from Moscow, Russia. On the same day, the actor registered my-github[.]com and pointed it at 193.32.204[.]199, the same IP used as an exfiltration endpoint. The deceptive page acted as a reverse proxy, harvesting the victim’s password and two-factor authentication code as they were typed. Security Arsenal said the actor approaches developers through issues, pull requests, or direct contact to get them to open a font-file payload.

JavaScript on the page silently authorized a GitHub OAuth device flow with repo, workflow, and read:org scopes. The stolen repository-scoped OAuth token went to my-github[.]com on TCP/8443 and gave the actor a reusable API credential to list repositories and inject workflow files under .github/workflows/. GhostAction had injected malicious GitHub Actions workflows into compromised projects to dump CI/CD secrets and exfiltrate them during workflow execution.

Those original workflows dumped GitHub tokens, cloud credentials, npm and PyPI package registry tokens, SSH keys, and signing material. Security Arsenal said stolen maintainer credentials are then used to push malicious workflow changes into victim repositories in a recursive loop. GitHub began preventing the original malicious workflow from running on October 9, 2026, and the October 10 and 12 waves extracted no secrets.

OpenSourceMalware said the font-based stage arrived six days after that block, around October 15, 2026, but the researcher could not say the block caused the pivot. The operator simply moved to a place GitHub’s controls do not reach. A Visual Studio Code tasks.json file with a runOn: folderOpen trigger ran automatically when a project folder opened in the editor, marking the second stage.

VS Code only runs automatic tasks in trusted workspaces, so opening or cloning a repository alone did not prove the malware executed. The malicious task uses the eslint-check label, invokes Node.js against the fake font, and uses presentation options to suppress terminal visibility. Microsoft’s Visual Studio Code documentation confirms runOn: folderOpen runs a task when its containing folder opens, making it documented functionality rather than a vulnerability.

The payload lived at public/fonts/fa-solid-400.woff2 and contained executable stealer code rather than font data. The fake font held 38 lines of unobfuscated Node.js code. When active, the payload gathers username, hostname, credential files, and environment variables and reads RSA and Ed25519 SSH private keys without truncation.

On systems supporting cron, the stealer installed a cron job that ran attacker-supplied code every five minutes. Windows systems lack the targeted crontab mechanism, although credential collection could still execute on those hosts. The cron entry carries marker #ghc2, removes matching entries before adding another, and pipes a retrieved script into Bash every five minutes, so persistence survives deletion of repository files because the cron job remains on the developer machine.

The stealer sent collected data to the same server over plain HTTP on port 8080, tied to IP address 193.32.204[.]199. The payload performs a recursive home-directory search for credential patterns and transmits collected information through an HTTP POST on port 8080. The stealer sought AWS keys, PyPI and npm tokens, Git logins, Kubernetes cluster credentials, SSH private keys, and credentials for AI providers including Anthropic Claude and Google Gemini.

Security Arsenal said the masqueraded stealer also harvests browser credential stores including Login Data, Local State, and cookies, plus session tokens and CLI tokens. A fallback GitHub Actions workflow ran if the infostealer never executed, reusing the original malicious workflow with added credential formats and uploading findings to a secret GitHub gist if the POST failed. Observed fallback workflow filenames included lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml, and cache-cleanup.yml.

Cyber Security News said the workflow scans reachable Git history using fetch-depth: 0, sometimes gathering nearby lines around AWS key IDs that may contain matching secret keys or account details. It sends collected data to attacker-controlled infrastructure over plain HTTP from a CI runner, where exfiltration can blend in with ordinary build network traffic. OpenSourceMalware counted 790 publicly recoverable, validated GhostAction repositories through October 9, 2026. GitGuardian reported 772 affected repositories between August 31 and September 30, 2026.

An October 8, 2026 burst across 346 repositories tied to the kitao and henrywoo accounts and Uber’s uber/athenadriver was reported by Socket and StepSecurity. OpenSourceMalware had not found malicious PyPI or crates.io releases linked to the latest burst as of October 9, 2026. Two repositories received the second-stage payload despite their owners previously removing malicious workflows.

Most of the still-accessible repositories appeared largely abandoned. 65 had no commit for more than a year, and one had been untouched for more than nine years. The compromised repositories belonged to 66 owners. 15 were later deleted, renamed, or made private, leaving 79 still accessible.

The font filename matched one from North Korea’s Fake Font/PolinRider campaign in January 2026, though researchers found no shared indicators proving the same operator. OpenSourceMalware said the available evidence did not establish a confirmed nation-state operator behind GhostAction. OpenSourceMalware flagged my-github[.]com as a high-priority indicator but did not prove the GhostAction operator registered it.

A similarly named my-gitlab[.]com domain predates my-github[.]com by 17 days, but no evidence connected the two to the same operator. OpenSourceMalware co-founder Jenn Gile said the operator remained unknown and the work suggested limited experience. Jenn Gile described the operator’s tradecraft as showing limited experience and operational mistakes: the stealer’s filter misses most API keys, its home-directory search can time out, and one IP handles exfiltration, phishing, and scanning.

Gile had not retrieved the server’s payload, leaving follow-on activity unresolved. The actor combined automation with social engineering to target people whose accounts access projects, organizations, registries, and downstream users. Aviatrix.ai said the incident reflects a playbook combining OAuth device-code phishing, IDE auto-execution abuse, and stealer malware disguised as assets to survive platform mitigations.

Aviatrix.ai said GitHub Actions supply-chain attacks surged through 2025 and 2026 and that platform controls alone were insufficient. Aviatrix.ai said AI provider credentials became a new exfiltration surface most existing egress and DLP policies did not yet cover. A newer workflow scans repository files for credential-like strings including AWS access keys and tokens for GitHub, GitLab, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter.

Aviatrix.ai said one compromised maintainer account can cascade stolen secrets across thousands of downstream consumers, amplifying blast radius and regulatory exposure. Security Arsenal said the reach extends to open-source maintainers and contributors, self-hosted and hosted GitHub Actions runners, and downstream consumers of packages from compromised accounts. Security Arsenal said workflow contexts routinely contain elevated tokens and long-lived credentials with write access to production infrastructure.

Security Arsenal said the actor is adapting by moving upstream to the person with the commit bit after defenders began auditing .github/workflows diffs. No CVE existed and no patch was available, making remediation behavioral, architectural, and detective. Security Arsenal said no CVE exists and CISA KEV does not apply because GhostAction is a campaign rather than a vulnerability.

Developers should revoke their GitHub access and tokens from a clean device and change their passwords. Teams should audit repositories, rotate every credential that workflows could reach, and alert users who cloned the affected repositories. Deleting malicious workflows did not revoke stolen tokens or remove credentials exposed through old Git history, so credential rotation followed containment from a clean device.

Teams that opened affected repositories should assume their local and repository credentials may have been exposed. Those teams should review OAuth grants, audit repository history and Actions logs, and revoke and rotate credentials. SparTech Software said GitHub’s security guidance recommends auditing secret handling and using minimally scoped credentials since a local stealer can bypass runner-focused protections.

Security Arsenal said remediation includes pinning third-party Actions to full commit SHAs and requiring CODEOWNERS review for changes to the .github/ directory. Security Arsenal said organizations should enable branch protection, set GITHUB_TOKEN to read-only, replace long-lived secrets with OIDC, and enable secret scanning plus push protection.

Security Arsenal said organizations should quarantine the 94 confirmed repositories and cross-reference OpenSourceMalware’s published list against direct and transitive dependency trees. Cyber Security News said defenders should preserve workflow files and commits, revoke credentials that enabled changes, and rotate every secret the workflow might reach.

Cyber Security News said GitHub’s secure use guidance recommends least-privilege access, workflow code review, and rotating secrets. SparTech Software said maintainers should treat dormant project code as untrusted and look for unexpected tasks.json files, folder-open tasks, the fake font filename, and workflows.