GhostAction Group Deploys Font‑Masquerading Credential Stealer Across Nearly a Hundred GitHub Repos

Security researchers have identified a new phase in the GhostAction supply‑chain campaign, in which the attackers placed a credential‑stealing payload hidden inside a counterfeit font file across 94 public GitHub repositories. The move expands the group's tactics beyond the malicious GitHub Actions workflows that previously compromised open‑source projects.

The malicious font, presented as a legitimate typeface, contains a lightweight stealer that activates when a developer downloads or previews the file. Once executed, the malware harvests stored credentials, SSH keys, and access tokens, then transmits the data to command‑and‑control servers controlled by the threat actors. By disguising the payload as a font, the attackers exploit the routine practice of developers incorporating external assets into projects without thorough verification.

GhostAction first gained notoriety for inserting harmful GitHub Actions scripts into vulnerable repositories, allowing the group to run arbitrary code in the context of the compromised projects. The latest development shows a shift toward direct phishing of open‑source contributors, targeting developers who clone or fork affected repositories. The researchers who uncovered the campaign say the dual‑vector approach—workflow injection plus malicious assets—creates a layered attack surface that is harder to detect.

The 94 repositories identified span a range of programming languages and include libraries used in web development, data analysis, and automation tools. While the exact impact on downstream users is still being assessed, the presence of the stealer in widely used components could expose thousands of developers to credential theft if the malicious fonts are incorporated into larger applications.

GitHub has responded by issuing a security advisory, urging maintainers to audit recent commits for unfamiliar files and to verify the provenance of any third‑party assets. The platform also highlighted its ongoing efforts to improve automated scanning for malicious code and non‑code files, though experts caution that sophisticated disguises like a fake font may evade standard detection mechanisms.

Cybersecurity analysts note that the GhostAction evolution reflects a broader trend in supply‑chain threats, where attackers blend code‑level exploits with social engineering to increase the likelihood of successful compromise. By targeting the human element—developers who routinely download assets from repositories—the group reduces reliance on technical vulnerabilities alone.

Mitigation steps recommended by security professionals include reviewing the contents of new files added to a project, employing hash‑based verification for third‑party resources, and rotating any credentials that may have been exposed. Organizations that depend on open‑source components are advised to adopt stricter dependency‑tracking policies and to monitor for unusual outbound network traffic that could indicate credential exfiltration.

The incident underscores the importance of vigilance in the open‑source ecosystem, where rapid collaboration can inadvertently open doors for malicious actors. As the investigation continues, both platform providers and the developer community will need to reinforce best practices to curb the spread of such covert threats.