credential stealer

GhostAction Threat Actors Expand Supply Chain Attack with Font-Based Credential Stealer

Researchers report that the GhostAction threat actor has expanded its supply chain attack beyond malicious GitHub Actions workflows, delivering credential-stealing malware disguised within fake font files across 94 GitHub repositories. The evolution was detailed by OpenSourceMalware and covered by The Hacker News on October 19, 2026.