GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

GhostAction attackers expanded beyond injecting malicious GitHub Actions workflows to phish open-source developers and deliver a credential stealer disguised as a fake font file, according to OpenSourceMalware. The malware has been planted in 94 GitHub repositories. The threat actor is actively refining its methods in response to defensive steps, signaling an evolving supply chain campaign.