Skip to content
Hacker Posts

GhostAction hides a credential stealer in a fake font file

A second-stage stealer disguised as fa-solid-400.woff2 was planted in 94 GitHub repos, harvesting AWS, npm, SSH, and Claude/Gemini keys via a VS Code tasks.json trigger.

Published 3 min read
breachgithubsupply-chainmalware

Attackers tied to the GhostAction GitHub supply-chain activity planted a second-stage credential stealer — disguised as a web font — in 94 repositories, according to OpenSourceMalware, whose researcher Paul McCarty published the analysis. It is a notable escalation from the earlier wave that injected malicious workflows into hundreds of repos: this stage targets developers' own machines.

How it works

The payload hides at public/fonts/fa-solid-400.woff2 — posing as a Font Awesome glyph file — but is a Node.js stealer. A .vscode/tasks.json file with a runOn: folderOpen trigger launches it when the project folder is opened in VS Code, after which it installs a cron job that re-runs attacker code every five minutes; a backup GitHub Actions workflow fires if the stealer never executes. It harvests AWS keys, npm and PyPI tokens, Git logins, Kubernetes credentials, SSH private keys, and AI-provider credentials for Anthropic Claude and Google Gemini.

Execution is not automatic on clone: VS Code requires a trusted workspace and permission for automatic tasks, so opening or cloning an affected repo is not proof the stealer ran. Of the 94 repos, 66 owners were involved, 15 have since been deleted, renamed, or made private, and 65 of the 79 still reachable had no commit in over a year.

A phishing component accompanies it: an email from noreply@my-github[.]com impersonated a GitHub security alert, and its link led to a reverse-proxy page that captured passwords and 2FA codes and silently authorized a GitHub OAuth device flow with repo, workflow, and read:org scopes.

Indicators

OpenSourceMalware published the following indicators (reproduced verbatim, defanged):

Domains:
  my-github[.]com     (phishing + C2)
  my-gitlab[.]com     (possibly related, unconfirmed)
IP:
  193.32.204[.]199    (exfiltration; reused from earlier GhostAction workflows)
Ports:
  TCP/8443            (OAuth token exfiltration)
  TCP/8080            (plaintext HTTP data exfiltration)
Files:
  public/fonts/fa-solid-400.woff2
  .vscode/tasks.json  (runOn: folderOpen)

Attribution caveat

OpenSourceMalware ties this to the GhostAction cluster but is explicit that the current infrastructure does not directly link it to the earlier GhostAction campaign, and that the fake-font launcher copies a pattern seen in the PolinRider campaign in January 2026. Treat the GhostAction label as a working hypothesis, not a confirmed lineage.

Action checklist

  1. Rotate every credential the stealer can reach — AWS, npm, PyPI, Kubernetes, SSH keys, and any Claude or Gemini API keys — from a known-clean device.
  2. Audit GitHub OAuth app authorizations and revoke anything granting repo, workflow, or read:org you did not approve; removing a malicious workflow does not revoke an already-issued token.
  3. Block the indicators above and search endpoints for public/fonts/fa-solid-400.woff2 and .vscode/tasks.json with a folderOpen task.
  4. Keep VS Code Workspace Trust on and disable automatic task execution for untrusted folders.

Context

The woff2-font trick is the newest twist on a now-familiar GitHub supply-chain playbook, and the reuse of exfiltration IP 193.32.204[.]199 from the earlier workflows is the thread that connects the waves. The move to a VS Code tasks.json trigger shifts the blast radius from CI secrets to the developer's workstation — the same direction several npm-ecosystem campaigns have taken this quarter.

Related stories