🤖 GhostAction evolves: after planting malicious GitHub Actions workflows, the crew now phishes open-source maintainers and hides an infostealer in a fake font file. OpenSourceMalware ties it to 94 compromised repos. Check your CI configs and recent deps.
🔗 https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
#CyberSec #Malware #SupplyChain #GitHub
The Hacker NewsGhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesGhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.