GhostAction Adds GitHub Phishing as GitHub Rolls Out Security Features
Summary
A podcast discusses GitHub push attribution and workflow lockfiles, GhostAction’s credential-stealing workflows and phishing of maintainers via my-github[.]com, and a DOJ operation that seized about 187 computers linked to North Korean IT worker schemes.
Key points
- GitHub push attribution, in public preview for Enterprise, shows when the account that pushed a commit differs from its listed committer; its availability and push-rule support may exclude many public repositories.
- GitHub Actions workflow lockfiles can prevent attackers from redirecting a workflow’s chosen tag to different code; setup requires a GitHub CLI extension, and the feature would not stop GhostAction.
- GhostAction uses a malicious GitHub Actions workflow to search repositories’ full Git histories for credentials.
- Operators reportedly registered my-github[.]com and used phishing alerts to target open-source maintainers; a tested reverse-proxy kit handled the GitHub MFA methods tested.
- The hosts associated with the campaign have also reportedly conducted mass internet scanning for about a year; the speakers said attribution remained unclear.
- The DOJ announced Operation Lonestar Roundup, with law-enforcement actions in Ohio and Texas and approximately 187 computers seized in connection with North Korean remote IT worker schemes.
Article Details
- Event Type
- Cybersecurity news roundup covering GhostAction phishing and software supply-chain activity, GitHub security feature announcements, and law-enforcement action against North Korean IT worker laptop farms.
- Impact
- The reported GhostAction activity includes a malicious GitHub Actions workflow that searches repository history for credentials and a phishing kit that proxies GitHub logins and reportedly handled the MFA methods tested. The speakers also report mass scanning associated with the same IP address. Separately, U.S. law-enforcement actions in Ohio and Texas resulted in arrests and the seizure of approximately 187 computers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | my-github[.]com | GitHub lookalike domain registered for phishing open-source maintainers with fake sign-in alerts. |
MITRE ATT&CK
People
Vendors
Products
GitHub ActionsGitHub Actions workflow lockfiles: Workflow lockfiles keep a GitHub Actions workflow pointed at the version you chose, even if an attacker moves the tag.GitHub Enterprisechanges and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open sourceTrivyThat should help against attacks like tj-actions and Trivy, though it wouldn’t stop GhostAction, and setup requires installing a GitHub CLI extension.