GhostAction Threat Actors Expand Supply Chain Attack with Font-Based Credential Stealer

The GhostAction threat actor, known for compromising GitHub repositories and injecting malicious workflows, has broadened its operations to include a credential-stealing malware campaign distributed via fake font files. According to researchers at OpenSourceMalware, the attack expansion targets open-source developers and projects on the GitHub platform. The malware is disguised within font files, a technique observed as part of the campaign's evolution beyond the initial GitHub Actions workflow injection method. The scope involves 94 repositories, though independent verification of the exact count and specific malware strain remains pending. The campaign poses risks of credential theft and compromise of developer machines, with potential downstream effects on supply chains that consume compromised repositories. OpenSourceMalware reported that the actors are actively refining their modus operandi in response to previous mitigations. The Hacker News reported on the development on October 19, 2026. No specific vendor advisories or CVEs have been assigned, as the campaign leverages social engineering and disguised file types rather than a patched software vulnerability.