GhostAction actors distribute credential stealer disguised as font in 94 GitHub repos

1. Executive summary

The GhostAction campaign has added a second delivery path: phishing of open-source developers to deliver a credential stealer hidden in a fake font file, now planted across 94 GitHub repositories, alongside the malicious GitHub Actions workflows that remain in active use. The workflow wave compromised roughly 1,900 GitHub accounts and reached more than 30,000 repositories across 3,000 users and organisations, with 3,174 secrets targeted in public repository CI on 8 and 9 October 2026. No CVE is associated with this item and no CISA KEV entry applies; the exposure is to source-control and CI/CD credentials, not to a patchable product. For EMEA financial services the risk sits with engineering organisations whose developers hold GitHub accounts and whose pipelines store cloud, AI and SaaS credentials as Actions secrets: any such secret present in a repository touched by the campaign should be treated as disclosed.

2. Regulatory framing

3. Technical analysis & attack chain

GhostAction is a credential-theft campaign against GitHub repositories. Two delivery mechanisms are now in use: direct injection of a malicious GitHub Actions workflow into repositories under a compromised maintainer account, and phishing of developers to deliver a stealer disguised as a font file. The font-delivery variant is reported by OpenSourceMalware and relayed by The Hacker News; the underlying report was not available in full, so the technical detail below on that variant is limited to what the news coverage states. The workflow mechanism is documented in more depth by Step Security.

Confirmed steps of the workflow attack chain:

1. Account compromise. The attacker obtains a maintainer's GitHub credential. Step Security assesses this is most plausibly a leaked personal access token from infostealer logs or credential dumps circulating among multiple actors. This is an assessment, not an observed fact.
2. Reconnaissance. The repository's workflow files are scanned for ${{ secrets.NAME }} references. The exact secret names found are templated into the payload before it is committed.
3. Injection. A workflow disguised as a security enhancement is committed directly to the default branch under the victim's own identity, bypassing pull requests. The next push, including the injection push itself, triggers it.
4. Exfiltration. The workflow POSTs the repository's secret values to an attacker-controlled endpoint using curl over plain HTTP.

The current wave adds a capability absent from the 2025 activity: the workflow exfiltrates not only the repository's named GitHub Actions secrets but every cloud, AI and SaaS credential findable in the working tree and the entire git history. Step Security's analysis of the run log from uber/athenadriver confirms the exfiltration completed, with the attacker's server acknowledging receipt four seconds after the workflow started.

Scale and timing. GitGuardian observed the spike on 8 and 9 October 2026: about 1,900 GitHub accounts compromised, more than 30,000 repositories across 3,000 users and organisations targeted, and 3,174 secrets targeted for extraction from public repository CI. Step Security recorded two automated windows on 8 October. Using the account of Takashi Kitao, author of the pyxel game engine, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu (henrywoo), original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10 to 21:26 UTC. The 345 repositories swept in those two windows are a subset of the wider 30,000-repository figure GitGuardian reports; the two counts come from different vendors and cover different scopes.

Workflow artefacts. The injected workflows are named "Security Audit" (security-audit.yml) and "Github Actions Security" (github_actions_security.yml). Step Security states that any repository where either file appeared since 31 August 2026 should be treated as a confirmed breach: every configured Actions secret and every credential pattern present anywhere in the git history was offered to the attacker, and the workflow beacons on every execution even when it finds nothing. The exfiltration endpoint has moved from the domains documented in September 2025 to a raw IP address; Step Security first observed the current endpoint in campaign use on 5 September 2026, in the earliest infected repository it analysed carrying it, and in honeypot records one day later. The 2025-era payload is still being deployed alongside the newer one.

The font-delivery variant. The Hacker News reports that the actor is now phishing open-source developers and delivering a stealer disguised within a fake font file, with 94 GitHub repositories used to host or distribute it. The article does not state the phishing lure, the font file format or name, the stealer family, its capabilities, or the hosting pattern. Those specifics are not available in the supplied material and should not be assumed. The article characterises the shift as the actor refining its methods in response to defensive steps; it does not identify which steps.

Attribution. The actor is tracked as GhostAction. No MITRE ATT&CK profile exists for this name, so the attribution is unconfirmed and the grouping should be treated as a campaign label rather than a profiled intrusion set. The overlap between the workflow campaign and the font-delivery activity rests on The Hacker News reporting a single source (OpenSourceMalware); the two should be handled as related until independent corroboration appears.

4. Mitigation & containment

P1 within 24 hours

• Search every organisation you own on GitHub for the campaign markers using the Code tab while logged in: org:your-org "AKIA_CTX_START", org:your-org "c=monami", org:your-org "193.32.204.199". A zero-result search is a good sign; any hit means an infected repository or a fork carrying the workflow. The org-wide equivalent without the org: qualifier searches all of GitHub.
• Treat any repository where security-audit.yml or github_actions_security.yml appeared since 31 August 2026 as a confirmed breach. Rotate every Actions secret configured on that repository and every cloud, AI and SaaS credential whose value appears anywhere in the working tree or git history, not only the current HEAD.
• Review the audit log for commits by maintainer identities adding those workflow files directly to default branches bypassing pull requests, for workflow_dispatch events on freshly created audit workflows, and for unsigned rapid-fire commits across many repositories within minutes.
• Revoke and reissue personal access tokens for any maintainer whose account shows those patterns, and require reauthentication.
• Block outbound HTTP from CI runners to 193.32.204.199 at the egress firewall or proxy.

P2 within 72 hours

• Enforce branch protection on default branches so workflow files cannot be committed without review, and require signed commits for changes under .github/workflows/.
• Scope Actions secrets to environments rather than repositories where the platform allows it, and remove secrets from repositories that do not need them.
• Add a CI policy check that fails a run when a workflow file is added or modified outside a pull request.
• For the font-delivery variant, brief developers on phishing that delivers files posing as fonts. The supplied reporting gives no file names, hashes or sender patterns, so detection must rest on user reporting and on mail and endpoint controls rather than on named indicators.

P3 within 7 days

• Inventory where cloud, AI and SaaS credentials are stored in repository content and history, and move long-lived keys out of git entirely.
• Add secret scanning with push protection across all organisations and forks.
• Review third-party risk arrangements with GitHub and CI/CD providers against DORA Art. 28 and Art. 30 expectations for notification and forensic cooperation.

5. Indicators of compromise

The three workflow markers and the endpoint are corroborated by Step Security's analysis of injected workflows, commit metadata and run logs, including a confirmed successful exfiltration in uber/athenadriver. No file hashes, domains, URLs or email indicators for the font-delivery variant appear in the supplied reporting; that indicator set is single-sourced to OpenSourceMalware via The Hacker News and is not reproduced here because the underlying values were not provided.

string  AKIA_CTX_START
string  c=monami
ipv4  193.32.204[.]199
filename  security-audit.yml
filename  github_actions_security.yml

6. Detection

The workflow markers are distinctive artefacts of the injected payload and support a file-based rule against workflow YAML.

rule GhostAction_Workflow_Exfil
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-19"
        reference = "https://www.stepsecurity.io/blog/ghostaction-returns"
        description = "Detects GhostAction injected GitHub Actions workflow by campaign markers and exfiltration endpoint"
    strings:
        $m1 = "AKIA_CTX_START" ascii
        $m2 = "c=monami" ascii
        $ip = "193.32.204.199" ascii
        $wf1 = "security-audit.yml" ascii
        $wf2 = "github_actions_security.yml" ascii
    condition:
        uint32(0) == 0x04034b50 or
        (2 of ($m1, $m2, $ip)) or
        (any of ($m1, $m2, $ip) and any of ($wf1, $wf2))
}

The workflow injection is also visible in GitHub audit logs. The Sigma rule below targets the commit and workflow-dispatch patterns Step Security describes.

title: GhostAction Workflow Injection via Direct Default-Branch Commit
id: 8f3c2a71-5b64-4d0e-9a17-6c2e4b8d1f05
status: experimental
description: Detects direct commits of audit-themed workflow files to default branches and workflow_dispatch on newly created audit workflows, consistent with GhostAction injection
author: Adverse Trace
date: 2026-10-19
references:

    - https://www.stepsecurity.io/blog/ghostaction-returns
logsource:
    product: github
    service: audit
detection:
    selection_commit:
        action: "git.push"
        repo|endswith:

            - "/.github/workflows/security-audit.yml"
            - "/.github/workflows/github_actions_security.yml"
    selection_dispatch:
        action: "workflows.dispatch"
        workflow|contains:

            - "security-audit"
            - "github_actions_security"
    filter_pr:
        pull_request|exists: true
    condition: (selection_commit and not filter_pr) or selection_dispatch
falsepositives:

    - Legitimate security tooling deployed by an approved pipeline with pull request review
level: high

The field names above follow GitHub audit log conventions; validate them against your own export schema before deployment. No detection content is offered for the font-delivery variant because the supplied reporting contains no artefacts for it.

7. Sources

• The Hacker News, GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories, https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html, 2026-10-19
• The Hacker News, GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories, https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html, October 2026
• Step Security, GhostAction Returns: Malicious "Security Audit" Workflows Now Mine Credentials from Entire Git Histories, https://www.stepsecurity.io/blog/ghostaction-returns, October 2026

8. Adverse Trace position

Adverse Trace assesses this as a high-impact credential exposure event for any financial services firm with active GitHub development, not because of a software vulnerability (none is involved and no CISA KEV entry applies) but because the campaign's current payload takes every cloud, AI and SaaS credential in a repository's history, and Step Security has confirmed successful exfiltration in at least one case. The font-delivery variant is single-sourced to OpenSourceMalware via The Hacker News and its technical detail is thin; we will not issue indicators for it until the underlying report or independent telemetry is available. The GhostAction attribution is unconfirmed, with no MITRE ATT&CK profile for the actor. We will monitor GitGuardian and Step Security publications for an updated repository and account count, watch for the first technical write-up of the font-delivery stealer, and reissue this advisory if either yields actionable indicators. Clients who find any of the three workflow markers in their organisations should contact us before rotating credentials so the scope of exposure can be established first.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.