As cited
Copy frozen at (site build).
threat intel
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
Threat actors behind the GhostAction supply chain attack have expanded their operations to distribute a credential stealer malware disguised as a font file across 94 GitHub repositories. The attackers have moved beyond injecting malicious GitHub Actions workflows to target open-source developers through phishing campaigns and deliver the stealer payload via the fake font.
Why it matters: Open-source developers and maintainers using GitHub are at immediate risk of downloading and running malicious code disguised as legitimate dependencies or build tools; practitioners should audit GitHub Actions in their projects and review recent commits and dependencies for suspicious font files or unusual additions.
- Source published
- First seen by Cybersecurity Tracker