GhostAction attackers hide credential stealer in a fake font across 94 GitHub repositories

Past-week coverage · Original source published 2026-10-19.

The group behind the GhostAction supply chain attack has changed tactics, according to reporting from The Hacker News citing OpenSourceMalware. Instead of only injecting malicious GitHub Actions workflows into compromised projects, the attackers are now phishing open-source developers and delivering stealer malware hidden inside a fake font file. The activity was found in 94 GitHub repositories.

The shift matters because it suggests the operators are adapting. The report describes the change as a response to steps taken against their earlier workflow-based approach, though the source does not detail what those countermeasures were or how effective they have been. The claim that the group is refining its methods comes from OpenSourceMalware's analysis, not from an independent confirmation.

For defenders, the practical lesson is that a repository can look clean at the workflow level and still carry risk through the people who maintain it. A font file is an ordinary-looking asset, which is what makes it a useful disguise. Maintainers should treat unexpected files and unsolicited approaches from apparent contributors with suspicion, and review what their build and release processes actually execute.

The source does not name victims, affected projects, or a fix. It also does not say whether the 94 repositories were cleaned up.