GhostAction's Font File Trick: How a Fake Woff2 Asset Stole Secrets from 94 GitHub Repos
In October 2026, the GhostAction threat actor escalated a supply-chain campaign by registering the phishing domain my-github[.]com and deploying a reverse-proxy kit that silently harvested GitHub credentials and 2FA codes, then stealthily authorized OAuth tokens with repo and workflow write permissions. The actor embedded a credential stealer inside a fake font file (fa-solid-400.woff2) committed to 94 repositories across 66 owners, using a VS Code tasks.json runOn:folderOpen trigger to persist on developer machines entirely outside GitHub's runner controls. The stealer harvested AWS keys, PyPI and npm tokens, Kubernetes credentials, SSH private keys, and AI provider secrets, exfiltrating everything over plain HTTP to a single attacker-controlled IP. This incident illustrates a maturing supply-chain playbook in which attackers combine OAuth device-code phishing, IDE auto-execution abuse, and stealer malware disguised as legitimate assets to survive platform-level mitigations. As open-source ecosystems grow more interconnected, a single compromised maintainer account can cascade stolen secrets across thousands of downstream consumers, amplifying both blast radius and regulatory exposure.
Kill Chain
