GhostAction Adds a VS Code-Launched Credential Stealer and Persistent Remote Access
Summary
Researchers found GhostAction malware in 94 repositories. A hidden VS Code task launches a credential stealer, while a cron job enables remote commands every five minutes; the campaign also uses malicious GitHub Actions workflows.
Key points
- Researchers identified the second stage in 94 repositories belonging to 66 owners; all 79 they could clone contained the VS Code task and fake font file.
- Opening an infected repository in a trusted VS Code workspace with automatic tasks allowed can run the hidden task, which launches plain JavaScript disguised as a font.
- The stealer collects credentials from files, SSH keys, environment variables and home-directory searches, then sends the report to the campaign server over HTTP.
- The malware installs a cron job that fetches and executes a server-provided script every five minutes; researchers had not retrieved that script and could not determine what it does.
- A second GitHub Actions workflow expands secret collection, including scanning repository wikis; researchers also found one workflow that sought cloud metadata credentials on a self-hosted runner.
- The researchers found no shared indicators between GhostAction’s second stage and PolinRider and characterize it as a copycat, not an established extension of that campaign.
- Removing malicious files or workflows may not revoke the access used to push them. The article advises revoking tokens and sessions, removing persistence, and rotating exposed credentials from a clean device.
Article Details
- Attack Vectors
- Stolen GitHub access was used to push malicious workflows to repositories the compromised account could write to; the workflows searched repository secrets and Git history for credentials.
- A hidden VS Code task configured to run on folder open launched JavaScript disguised as a font file when automatic tasks were allowed in a trusted workspace.
- The JavaScript read credential files, SSH private keys, and selected environment variables, then sent collected data to the GhostAction server.
- The malware installed a cron job that fetched and executed commands from the server every five minutes.
- A second workflow scanned additional credential formats and the repository wiki, with a secret-gist fallback if its POST failed.
- Defensive Notes
- Revoke GitHub sessions, personal access tokens, OAuth authorizations, GitHub App installations, SSH keys, and deploy keys before cleaning infected repositories; then change the password and enable phishing-resistant MFA.
- Inspect every repository the account can write to, including forks, for malicious workflows, a hidden eslint-check task in .vscode/tasks.json, fake font files under public/fonts, and config files with concealed trailing code. Remove malicious files from all branches.
- Rotate repository Actions secrets and credentials committed anywhere in Git history, and check package registry release histories for unauthorized releases.
- On macOS and Linux, inspect crontab for entries containing the server IP or the #ghc2 marker. Treat machines where the task ran as potentially compromised and rotate credentials from a clean device after containment.
- Require approval for workflow runs, protect .github/workflows with required reviews, and block force-pushes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]32[.]204[.]199 | GhostAction server used for credential exfiltration and to serve commands to the installed cron job. |
| SHA256 | 40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c | Hash of a reference malicious second-stage workflow. |
| SHA256 | 61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6 | Hash of the malicious fake font file with the auto_20261015 batch tag. |
| SHA256 | 6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19 | Hash of the first malicious security-audit workflow version. |
| SHA256 | 92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db | Hash of the malicious fake font file with the auto_20261014 batch tag. |
| SHA256 | a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb | Hash of the malicious .vscode/tasks.json launcher. |
| SHA256 | cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60 | Hash of the malicious fake font file with the reinject batch tag. |
| SHA256 | d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f | Hash of the second malicious security-audit workflow version. |
| URL | hxxp[:]//193[.]32[.]204[.]199:8080/?c=auto_20261013 | Malicious exfiltration URL using a date-stamped batch tag. |
| URL | hxxp[:]//193[.]32[.]204[.]199:8080/?c=reinject | Malicious infostealer exfiltration URL identified in the article. |
| URL | hxxp[:]//193[.]32[.]204[.]199:8080/?c=security | Malicious Stage 1 exfiltration URL used in an early variant. |
| URL | hxxp[:]//193[.]32[.]204[.]199/?c=new | Malicious Stage 1 exfiltration URL from the first version. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware sends its collected credential report to the GhostAction server in an HTTP POST.T1053.003 · CronThe malware installs a cron entry that requests and executes server-provided commands every five minutes.T1059.004 · Unix ShellThe cron job pipes commands fetched from the server into bash for execution.T1059.007 · JavaScriptThe fake font file contains JavaScript executed by Node.js to collect credentials and install persistence.T1071.001 · Web ProtocolsThe implant communicates with its server over HTTP for credential exfiltration and to retrieve commands.T1082 · System Information DiscoveryThe malware includes the machine's username and hostname in its report and uses the hostname in the command-fetch path.T1083 · File and Directory DiscoveryThe stealer checks specific credential and SSH-key paths and recursively searches the home directory for tokens.T1105 · Ingress Tool TransferThe cron job fetches a script from the server and executes it on the compromised machine.T1552.001 · Credentials In FilesThe stealer reads credential files including .aws/credentials, .npmrc, .git-credentials, and .kube/config.T1552.004 · Private KeysThe stealer reads the user's id_rsa and id_ed25519 private key files.
People
Products
GitHub ActionsWe’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow.VS CodeNew Stage 2: Commit a tasks.json file and public/fonts/fa-solid-400.woff2, which makes VS Code autorun a credential stealer and install a cron job that runs whatever the attacker’s server sends, every five minutes.