GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The GhostAction threat actor has expanded its supply chain attack campaign beyond injecting malicious GitHub Actions workflows. The group is now targeting open-source developers by phishing them and delivering credential-stealing malware disguised as a fake font file. The campaign has been observed across 94 GitHub repositories. Research from OpenSourceMalware indicates the attackers are actively evolving their tactics in response to detection and mitigation efforts. The shift from workflow injection to font-disguised stealers represents a notable refinement in their operational approach. This campaign poses a significant risk to open-source developers and the broader software supply chain.