The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, the GhostAction threat actor escalated a supply-chain campaign by registering the phishing domain my-github[.]com and deploying a reverse-proxy kit that silently harvested GitHub credentials and 2FA codes, then stealthily authorized OAuth tokens with repo and workflow write permissions. The actor embedded a credential stealer inside a fake font file (fa-solid-400.woff2) committed to 94 repositories across 66 owners, using a VS Code tasks.json runOn:folderOpen trigger to persist on developer machines entirely outside GitHub's runner controls. The stealer harvested AWS keys, PyPI and npm tokens, Kubernetes credentials, SSH private keys, and AI provider secrets, exfiltrating everything over plain HTTP to a single attacker-controlled IP.

This incident illustrates a maturing supply-chain playbook in which attackers combine OAuth device-code phishing, IDE auto-execution abuse, and stealer malware disguised as legitimate assets to survive platform-level mitigations. As open-source ecosystems grow more interconnected, a single compromised maintainer account can cascade stolen secrets across thousands of downstream consumers, amplifying both blast radius and regulatory exposure.

Why This Matters Now

GitHub Actions supply-chain attacks surged through 2025–2026, and GhostAction's pivot to IDE-level persistence demonstrates that platform controls alone are insufficient. With AI provider credentials now explicitly targeted alongside cloud and registry secrets, organizations running LLM-integrated pipelines face a new exfiltration surface that most existing egress and DLP policies do not yet cover.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The actor committed a VS Code tasks.json file configured with a runOn:folderOpen trigger alongside a stealer payload disguised as a font file, causing the credential harvester to execute automatically whenever the compromised repository folder was opened in VS Code—completely bypassing GitHub's runner controls.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's ability to move laterally across CI/CD environments, reach cloud workloads, and exfiltrate secrets over uncontrolled outbound paths all depend on network reachability that segmentation-based controls would likely constrain. By enforcing workload-level segmentation and controlled egress, the blast radius across the 94 infected repositories and downstream cloud environments could be meaningfully reduced.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Consistent identity-aware access policies across cloud-connected developer environments would likely reduce the reachability of attacker-controlled infrastructure, making it harder for malicious OAuth callback flows and reverse-proxy endpoints to silently complete without scrutiny at the network boundary.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation applied to cloud workload identities and CI/CD runner environments would likely limit how far a compromised token's access could propagate across cloud infrastructure boundaries, reducing the scope of what an authenticated-but-unauthorized principal could reach.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls between CI/CD runner environments, developer workstation segments, and cloud workloads would likely reduce the attacker's ability to freely pivot across those boundaries, limiting how far injected payloads could communicate once activated on a developer machine.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility across workload egress paths would likely surface anomalous outbound connections to a single external IP on non-standard ports, and centralized control policies could reduce the attacker's ability to maintain a reliable command and control channel from cloud-adjacent developer environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policies enforced at the network boundary would likely constrain plaintext data transmission over port 8080 to an unrecognized external IP, reducing the attacker's ability to reliably exfiltrate harvested credentials from developer or cloud-connected environments on a repeating schedule.

Impact (Mitigations)

Even where credential theft succeeded, the attacker's ability to leverage harvested AWS keys, Kubernetes credentials, and cloud tokens against live infrastructure would likely be reduced if those environments enforced workload-level segmentation — meaning stolen credentials may not translate directly into broad cloud environment access without hitting policy enforcement boundaries.

Impact at a Glance

Affected Business Functions

  • Open-Source Software Supply Chain Integrity
  • Developer Credential and Secret Management
  • CI/CD Pipeline and GitHub Actions Workflow Security
  • Downstream Software Consumer Trust and Package Integrity
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Credentials harvested across 94 compromised GitHub repositories belonging to 66 distinct maintainers. Stolen data categories include: AWS access keys and secret keys, PyPI API tokens, npm authentication tokens, Git credentials (username and password or personal access tokens), Kubernetes cluster kubeconfig credentials, SSH private keys, AI provider API keys for Anthropic Claude and Google Gemini, and GitHub OAuth access tokens with repo, workflow, and read:org scopes. The OAuth tokens grant write access to repositories and Actions workflows, enabling persistent downstream supply-chain compromise. Any downstream user or organization that cloned or consumed packages from affected repositories is at risk of receiving backdoored or tampered software artifacts. The stealer also installs a persistent cron job executing attacker-controlled code every five minutes on developer machines, extending data exposure beyond the initial compromise window.

Recommended Actions

  • • Enforce egress filtering and FQDN-based policy (Egress Security & Policy Enforcement): Block outbound connections from CI/CD runners and developer workstations to unknown or newly registered domains such as my-github[.]com; enforce allow-list egress policies that prevent plaintext HTTP exfiltration over non-standard ports (8080, 8443) to unapproved destinations, directly disrupting the stealer's primary and fallback C2 channels.
  • • Deploy Cloud Firewall (ACF) with URL filtering for outbound developer traffic: Apply internet egress controls that inspect and restrict outbound traffic from build pipelines and developer endpoints to known-good destinations; AI-assisted traffic discovery can surface anomalous POST requests to newly registered lookalike domains and flag stealer beaconing behavior before credentials leave the environment.
  • • Apply Zero Trust Segmentation and least-privilege OAuth scope enforcement: Limit OAuth token permissions granted through CI/CD integrations to the minimum required scopes; implement identity-based microsegmentation policies that prevent a single compromised developer token from traversing across multiple repositories and organizations, containing the blast radius of the workflow injection.
  • • Enable Multicloud Visibility & Control to monitor CI/CD and cloud API anomalies: Instrument centralized traffic observability across GitHub Actions runners, AWS, Kubernetes, and AI provider API calls to detect anomalous automation patterns—such as bulk repository enumeration, repeated workflow file writes, and unexpected credential API calls—that indicate post-compromise token abuse.
  • • Use Inline IPS (Suricata) and Encrypted Traffic enforcement to detect and block stealer payloads in transit: Deploy inline inspection on egress paths from developer networks to detect known stealer payload signatures and block plaintext credential exfiltration over HTTP; enforce encrypted traffic standards (MACsec/IPsec) on internal and hybrid connectivity paths to prevent opportunistic packet sniffing of harvested secrets transiting internal networks before reaching the exfiltration endpoint.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image