GhostAction Campaign Adds OAuth Phishing and a Persistent Credential Stealer to 94 GitHub Repositories
Summary
OpenSourceMalware says GhostAction attackers used OAuth phishing and a VS Code-triggered stealer in 94 GitHub repositories. The stealer persists on developer machines; researchers recommend revoking access, rotating credentials, and auditing repositories.
Key points
- OpenSourceMalware linked a GitHub-themed phishing domain, my-github[.]com, to the campaign’s reported exfiltration infrastructure.
- The phishing page allegedly reverse-proxied GitHub logins, captured passwords and 2FA codes, and automated OAuth device-flow authorization for repository and workflow access.
- A second-stage component in 94 repositories reportedly triggered a credential stealer through VS Code and installed a cron job to run attacker-supplied code every five minutes.
- Researchers said the repositories belonged to 66 owners; 15 had been deleted, renamed, or made private.
- After GitHub blocked the malicious workflow on October 9, 2026, later waves reportedly extracted no secrets; the second stage did not require a GitHub runner. Researchers cautioned they could not say the block caused the change.
- Recommended steps include revoking GitHub access and tokens from a clean device, changing passwords, auditing repositories, rotating reachable credentials, and alerting repository users.
Article Details
- Attack Vectors
- Phishing email impersonating a GitHub security alert directs an open-source maintainer to a deceptive page.
- The page reverse-proxies GitHub authentication to capture passwords and 2FA codes, and automates OAuth device-flow authorization to obtain a repository-scoped access token.
- Malicious GitHub Actions workflows enumerate repositories, search for credentials, and send collected data to an attacker-used server.
- A second-stage credential stealer disguised as a font is planted in compromised repositories; it runs on developer machines and installs a cron job that executes attacker-supplied code every five minutes.
- Defensive Notes
- Revoke GitHub access and tokens from a clean device, change passwords, and rotate every credential accessible to the workflows.
- Audit repositories and alert users who have cloned them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | my-github[.]com | Attacker-registered domain used for phishing and to receive exfiltrated access tokens. |
noreply@my-github[.]com | Sender address used in a phishing email impersonating a GitHub security alert. | |
| IPV4 | 193[.]32[.]204[.]199 | IP address identified as an exfiltration endpoint for data collected by the malicious workflow. |
MITRE ATT&CK
T1053.003 · CronThe credential stealer installed a cron job to run attacker-supplied code every five minutes.T1056.003 · Web Portal CaptureThe deceptive reverse-proxy page harvested the victim's password and 2FA code.T1071.001 · Web ProtocolsThe second-stage component sent collected data to the same server over plain HTTP on port 8080.T1528 · Steal Application Access TokenThe phishing flow silently authorized a GitHub OAuth device flow to obtain a reusable repository-scoped access token.T1566.002 · Spearphishing LinkA phishing email impersonating a GitHub security alert instructed a maintainer to click a link.
People
Products
GitHubThe threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malwareGitHub ActionsThe threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malwareVS CodeThis causes VS Code to auto-run the credential stealer, which, besides collecting data, installs a cron job that runs attacker-supplied code every five minutes. The collected data is sent to the same server over plain