GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
Summary
The threat actor known as GhostAction has escalated its supply chain attack by planting a credential-stealing malware disguised as a font file within 94 GitHub repositories. This evolution signifies a refinement of their tactics, moving beyond malicious GitHub Actions workflows to directly phish open-source developers.
IFF Assessment
This report details a sophisticated supply chain attack that targets open-source developers with malware, posing a direct threat to the security of software projects and developer credentials.
Defender Context
Defenders should be aware of this evolving supply chain attack targeting open-source developers via GitHub. It highlights the need for enhanced vigilance regarding suspicious files, even those appearing innocuous like font files, within development environments and to strengthen authentication mechanisms to mitigate credential theft.