Full Report
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Analysis Summary
# Threat Actor: Unattributed operators of the GhostAction campaign
## Attribution & Identity
- **Name/Alias:** No formal name or alias is given in the article. The actor is referred to only as the operator of the "GhostAction" supply chain attack. The article's redaction ("****") obscures the campaign name in its headline, but GhostAction is the label used for this activity.
- **Attribution confidence:** Low. The article does not attribute the campaign to a named group or nation-state.
- **Associated groups:** None identified. The article notes that the "my-github[.]com" domain is linked to GhostAction through its shared IP address (193.32.204[.]199). However, the related "my-gitlab[.]com" domain was registered 17 days earlier, and researcher Paul McCarty of OpenSourceMalware said there is no infrastructure connection to GhostAction. Different registrars, registrant records, Cloudflare nameserver pairs, IP addresses, ASNs, DNS designs, and certificates were observed.
- **Researcher attribution:** OpenSourceMalware (Paul McCarty) is the primary source of the findings.
## Activity Summary
- **Original GhostAction activity:** The operators injected malicious GitHub Actions workflows into compromised repositories. The workflows enumerated repositories and exfiltrated harvested data to 193.32.204[.]199.
- **Evolution:** The actor is adapting after GitHub blocked the workflow from running. The new approach adds social engineering and OAuth abuse.
- **Phishing campaign:** The domain my-github[.]com was registered on October 9, 2026, and used the same day. A phishing email from noreply@my-github[.]com posed as a GitHub security alert about a login from Moscow, Russia, and targeted an open-source maintainer.
- **Credential harvesting:** The phishing page acted as a reverse proxy that captured the victim's password and 2FA code. It then injected JavaScript to authorize a GitHub OAuth device flow with `repo`, `workflow`, and `read:org` scopes, with the resulting token sent to my-github[.]com on TCP/8443.
- **Second-stage persistence:** The campaign reportedly commits files to repositories that persist on developer machines after the malicious workflow is removed. The article describes a VS Code `tasks.json` file with a `runOn: folderOpen` trigger. It mentions a third file, but the excerpt is truncated and the details are not available.
- **Malware delivery:** The actor delivers a credential stealer disguised as a fake font file.
## Tactics, Techniques & Procedures
- **Supply chain compromise via malicious workflows:** Injection of files under `.github/workflows/` into compromised repositories to run payloads and exfiltrate data. *(Suggested mapping: T1195.002 Compromise Software Supply Chain)*
- **Spearphishing with a fake security alert:** A spoofed GitHub security notification with a link to a credential-harvesting page. *(Suggested: T1566.002 Phishing: Spearphishing Link)*
- **Reverse-proxy adversary-in-the-middle:** The phishing page proxies the real GitHub login to capture passwords and 2FA codes. *(Suggested: T1557 Adversary-in-the-Middle)*
- **Automated OAuth device code phishing:** Scripts receive a device and user code, load `/login/device`, extract GitHub's forms, insert the user code, add `authorize=1`, and submit approval through the victim's proxied session. The victim does not need to enter the code or consciously approve. *(Suggested: T1528 Steal Application Access Token)*
- **Overprivileged OAuth scopes:** `repo`, `workflow`, and `read:org` grant read/write access to repositories, the ability to modify Actions workflows, and visibility into organization membership. *(Suggested: T1098.003 Additional Cloud Roles, or T1078 Valid Accounts for reuse of the token)*
- **Malicious VS Code auto-run:** A `tasks.json` file with `runOn: folderOpen` executes when a project is opened, enabling persistence on developer machines. *(Suggested: T1204.002 User Execution: Malicious File, or T1546 Event Triggered Execution)*
- **File type masquerading:** A stealer is disguised as a font file. *(Suggested: T1036.008 Masquerade File Type)*
- **Non-standard port exfiltration:** Tokens are sent over TCP/8443. *(Suggested: T1571 Non-Standard Port)*
- **Domain lookalikes:** Domains use the "my-[service].com" naming pattern, which the actor may reuse.
*Note: The article does not list MITRE ATT&CK IDs. The IDs above are analyst suggestions based on the described behavior.*
## Targeting
- **Sectors:** Open-source software development and the developer community. Targets include maintainers whose accounts provide access to projects, organizations, package registries, and downstream users.
- **Geography:** Not specified. The "Moscow, Russia" location appears only in the spoofed login alert and does not indicate the actor's location.
- **Victims:**
- An unnamed open-source maintainer targeted by the phishing email on October 9, 2026.
- Repositories compromised through the original GhostAction workflow injection (the article mentions 94 GitHub repositories in its headline).
## Tools & Infrastructure
- **Malware families:** A credential stealer disguised as a font file. The family name is not provided. The GhostAction workflow payload is also referenced but not named.
- **Infrastructure:**
- Phishing/exfiltration domain: my-github[.]com (registered October 9, 2026)
- Related domain (unconfirmed link): my-gitlab[.]com
- Exfiltration IP address: 193.32.204[.]199
- Exfiltration port: TCP/8443
- Email sender: noreply@my-github[.]com
- Infrastructure uses Cloudflare nameservers, though the specific pairs are not provided.
- **Access abused:** GitHub OAuth device flow tokens with `repo`, `workflow`, and `read:org` scopes.
## Implications
- **Shift toward human-targeted attacks:** The actor is moving beyond automated workflow injection to direct phishing of maintainers. This makes it more difficult to defend with technical controls alone, because it circumvents GitHub's workflow restrictions.
- **Reusable credentials:** A stolen OAuth token gives the attacker persistent API access that survives password resets, unless the authorization is revoked.
- **Downstream supply chain risk:** Compromising a maintainer account can lead to malicious changes in packages or workflows that reach downstream users and registries.
- **Persistence beyond the repository:** The VS Code auto-run technique can infect developer workstations even after the repository is cleaned, increasing the likelihood of credential theft from local machines.
- **Adaptive operations:** The actor is responding to platform defenses in near real time, which suggests a motivated and resourceful operator. The technique of mimicking North Korean tactics (per the article's linked reference) is a tactic borrowing, not evidence of attribution.
- **Overall threat level:** High. The campaign combines supply chain compromise, credential theft, MFA bypass, and persistent access.
## Mitigations
- **Restrict OAuth app authorization:** Enable GitHub's OAuth app access restrictions for organizations. Require approval for third-party apps requesting `repo`, `workflow`, or `read:org` scopes. Review and revoke unfamiliar authorized apps regularly.
- **Harden against device code phishing:** Use phishing-resistant MFA (FIDO2/passkeys) to reduce the effectiveness of reverse-proxy credential capture. Educate maintainers that legitimate GitHub prompts do not require entering device codes from unsolicited emails.
- **Verify security alerts out of band:** Instruct users to navigate directly to github.com rather than clicking links in login or security alert emails. Block or flag emails from lookalike domains such as my-github[.]com and my-gitlab[.]com.
- **Block indicators:** Block my-github[.]com and 193.32.204[.]199 at DNS, web proxy, and firewall layers. Block outbound TCP/8443 to unapproved destinations where feasible. Monitor for connections to these indicators in historical logs.
- **Audit repositories:** Review `.github/workflows/` for unauthorized or recently added workflow files, particularly those that exfiltrate data. Check for unexpected commits adding `.vscode/tasks.json` files with `runOn: folderOpen`.
- **Secure developer workstations:** Disable or restrict automatic task execution in VS Code (workspace trust settings). Scan for fake font files or other files with mismatched types. Treat cloned repositories from untrusted sources with caution.
- **Rotate credentials after exposure:** If compromise is suspected, revoke all OAuth tokens and personal access tokens, rotate secrets stored in repositories, and review organization audit logs for unauthorized changes.
- **Monitor OAuth activity:** Review GitHub audit logs for device flow authorizations, new OAuth grants, and workflow file modifications.