highMalware
GhostAction Threat Actors Expand Supply Chain Attack with Font-Based Credential Stealer
Researchers report that the GhostAction threat actor has expanded its supply chain attack beyond malicious GitHub Actions workflows, delivering credential-stealing malware disguised within fake font files across 94 GitHub repositories. The evolution was detailed by OpenSourceMalware and covered by The Hacker News on October 19, 2026.
The Hacker News1 min read