GhostAction’s latest evolution combines fake GitHub security alerts with a credential-stealing second stage.
The phishing page captured passwords and two-factor codes, then silently authorized an OAuth device flow with repository, workflow and read:org scopes.
A font file carried a stealer targeting developer credentials, including AWS keys, PyPI and npm tokens, SSH keys and Kubernetes credentials.
Researchers identified the component in 94 compromised repositories.
In their new attempt, the perpetrators registered the website my-github.com on October 9, 2026. They used it in a deceptive email message that pretended to be a security alert from GitHub. The message warned of a supposedly new login to the account from Moscow and asked the victim to click a link to protect their account.
The login led to a fake login page that secretly acted as a middleman. This way, the attackers could steal passwords and two-step verification codes, while silently granting automatic account access to the creators' works.
In addition to the emails, the operation included a second stage that remained on the creators' devices. Among other things, they used special development environment configuration files that were automatically activated when the folder was opened, as well as a fake font file that hid a dangerous program.
READ ALSO
Fake group approached cryptocurrency startups promising funding to install malware
This program aimed to steal digital keys and login credentials from various code storage services, software development tools, server management systems, and artificial intelligence service providers.
Security researchers identified a total of 94 compromised code repositories from 66 different owners, 15 of which were deleted, renamed, or made private. GitHub, for its part, began preventing the execution of the dangerous code on October 9, 2026, while the details of the development were analyzed by the OpenSourceMalware team with the input of security researchers.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)