The actor behind the GhostAction supply-chain attack has moved beyond injecting malicious GitHub Actions workflows, adding a second stage that persists on developer machines after the workflow is removed. OpenSourceMalware identified 94 compromised repositories belonging to 66 owners, 15 of which have since been deleted, renamed or made private, carrying a Visual Studio Code tasks.json file with a runOn: folderOpen trigger, a "public/fonts/fa-solid-400.woff2" file that is in fact a stealer, and a fallback CI workflow. Opening the folder runs the stealer, which harvests AWS keys, PyPI and npm tokens, Git logins, Kubernetes cluster credentials, SSH private keys and Anthropic Claude and Google Gemini API credentials, installs a cron job executing attacker code every five minutes, and exfiltrates over plain HTTP on port 8080. The fake-font filename copies North Korea's Fake Font/PolinRider campaign, and most repositories are abandoned: 65 of 79 had gone more than a year without a commit. The operator also registered my-github[.]com on 9 October, using it in a fake GitHub security-alert email whose reverse-proxied login page captured passwords and 2FA codes and silently authorised a device-flow OAuth app with repo, workflow and read:org scopes. Stage 2 arrived six days after GitHub began blocking the malicious workflow.

• Source article