The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects. According to OpenSourceMalware, they now also target open-source developers directly with phishing emails that impersonate GitHub security alerts, using a domain my-github[.]com that points to the same IP address used for data exfiltration.
The phishing email warned of a login from Moscow and led to a reverse-proxy page that harvested passwords and two-factor authentication codes. It also injected JavaScript to silently authorize a GitHub OAuth app with workflow and repository permissions, automating device-code phishing to obtain a reusable token. This gives the attacker broad access to read and write repositories, modify workflow files, and view organization membership.
The campaign also includes a second-stage component that persists on developer machines. It uses a VS Code tasks.json file that runs when a folder is opened, and a fake font file (fa-solid-400.woff2) containing a stealer for AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH private keys, and AI provider credentials for Anthropic Claude and Google Gemini. A fallback workflow uploads findings to a secret GitHub gist if the initial exfiltration fails. The font filename matches one used in North Korea's PolinRider campaign.
OpenSourceMalware identified 94 compromised repositories belonging to 66 owners, with 15 deleted, renamed, or made private. Most of the accessible repositories were largely abandoned, with one untouched for more than nine years. GitHub began blocking the original malicious workflow on October 9, and the second stage arrived six days later, suggesting the operator moved to a place GitHub's controls don't reach. The source notes it is unclear whether the block caused the shift, but the timing is notable.