GhostAction Phishing Kit Targets Open-Source Maintainers With Credential Theft and OAuth Automation

Oct 11, 2026 · Original article ↗

Summary

GhostAction used a GitHub lookalike to phish a maintainer, capture credentials, and automate OAuth device authorization for repository and workflow access. A victim was stopped by an additional MFA challenge; successful token theft was not confirmed.

Key points

A personalized fake GitHub security alert sent a maintainer to my-github[.]com, hosted on infrastructure associated with GhostAction.
Recovered pages and a HAR document a reverse proxy that collected submitted login credentials and included an authenticator-code prompt.
Injected JavaScript attempted to authorize an OAuth device flow requesting repo, workflow, and read:org scopes, then send the token to the campaign domain.
The source confirms the token-exfiltration capability, but the HAR did not show the OAuth flow completing or a token being exfiltrated.
The victim was not compromised: an additional MFA challenge stopped the attacker after a successful login; passwords were changed and account activity was reviewed.
The evidence links developer phishing to GhostAction’s malicious-workflow activity, but does not prove phishing caused earlier account compromises.
Defenders should block and hunt the phishing domain and related indicators, revoke suspicious sessions and OAuth grants, and review repositories, workflows, keys, and reachable secrets.

Article Details

Attack Vectors: Personalized phishing email impersonating a GitHub security alert and directing maintainers to my-github[.]com.
Reverse-proxy phishing pages collected GitHub usernames, passwords, and one-time codes through attacker-controlled routes.
Injected JavaScript automated a GitHub OAuth device flow requesting repo, workflow, and read:org scopes; the script was designed to send the resulting access token to the campaign domain on TCP/8443. Successful token issuance or exfiltration was not observed in the captured browser session.
GhostAction workflows searched repositories and reachable Git history for secrets and sent collected results to 193.32.204[.]199.
Defensive Notes: Block and hunt for the listed my-github[.]com domains and phishing URLs, and search email telemetry for the sender and the “New sign-in from Moscow, Russia” subject fragment.
Treat 95.214.27[.]108 as an IP used in the phishing lure, not as confirmed attacker infrastructure.
If a recipient interacted with the link, preserve browser, DNS, proxy, and endpoint telemetry before cleanup.
Revoke GitHub sessions and tokens, reset credentials, review SSH and GPG keys and OAuth or GitHub App authorizations, and remove unfamiliar grants associated with client ID Ov23ctrqCqZ79UaYKwyq.
Inspect accessible repositories and organizations for unexpected workflows, direct pushes, release changes, deploy keys, webhooks, and trigger-only commits; rotate reachable package, cloud, deployment, and CI/CD credentials.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]my-github[.]com`	Attacker-controlled subdomain used by the phishing application for proxied API routes and browser telemetry.
DOMAIN	`collector[.]my-github[.]com`	Attacker-controlled subdomain used by the phishing application for analytics submissions.
DOMAIN	`docs[.]my-github[.]com`	Attacker-controlled subdomain used by the phishing application for proxied documentation links.
DOMAIN	`github[.]my-github[.]com`	Attacker-controlled subdomain used by the reverse-proxy phishing application to serve GitHub-related assets.
DOMAIN	`my-github[.]com`	Confirmed phishing domain associated with GhostAction and hosted on the campaign server.
DOMAIN	`support[.]my-github[.]com`	Attacker-controlled subdomain used by the phishing application for proxied support links.
EMAIL	`noreply@my-github[.]com`	Sender address shown in the phishing email; the original sender authentication was unavailable.
IPV4	`193[.]32[.]204[.]199`	Confirmed GhostAction server used to host the phishing domain and receive collected CI/CD, repository, and secret data.
SHA256	`68c20885a3e234c9eb1e4f87a7013298923646f9c50dfdad97a9e35d989119f8`	SHA-256 of the recovered redirect-controller JavaScript used by the phishing kit.
SHA256	`e6bdd7e782ef2fbf42209509993811a63ae19f1580d2453b8324b87db5ad1449`	SHA-256 of the captured redirect response served by the campaign infrastructure.
URL	`hxxps[:]//my-github[.]com:8443/t`	Campaign listener identified in the source as the destination for OAuth access-token exfiltration; successful receipt was unverified.
URL	`hxxps[:]//my-github[.]com/login`	Attacker-hosted credential collection page confirmed by screenshot and recovered source.
URL	`hxxps[:]//my-github[.]com/SDRVuhYw`	Targeted phishing URL; the path was confirmed and its redirect behavior changed during the campaign.
URL	`hxxps[:]//my-github[.]com/session`	Attacker-controlled route receiving the phishing login form submission.
URL	`hxxps[:]//my-github[.]com/sessions/two-factor/app`	Attacker-hosted authenticator-code phishing page confirmed by screenshot.