GhostAction Attackers Turn to Phishing and Fake Font Files to Target Open-Source Developers

The threat actor behind the GhostAction supply chain attack has widened its approach. Beyond injecting malicious GitHub Actions workflows into compromised projects, the group is now phishing open-source developers and delivering stealer malware disguised as a font file. Researchers at OpenSourceMalware say this shows the attackers are adapting in response to steps GitHub has taken to stop the malicious workflow from running.

According to the researchers, the attacker registered the domain my-github[.]com on October 9, 2026, and pointed it at the same IP address used to receive data stolen by the malicious workflow. On the day it was registered, it was used in a phishing email posing as a GitHub security alert. The message claimed a new login from Moscow, Russia, and urged an open-source maintainer to click a link to secure their account. A similar domain, my-gitlab[.]com, was registered 17 days earlier, but researcher Paul McCarty said current evidence does not directly link it to GhostAction.

The fake login page reportedly acted as a reverse proxy, capturing the victim's password and two-factor authentication code. It also ran JavaScript that authorised an OAuth app with permissions to read and write repositories, modify workflow files and view organisation membership. The goal was to obtain an access token and send it to the attacker's domain, similar to device code phishing. That access could then support another GhostAction-style attack.