GhostAction attackers hide credential stealer in fake font across 94 GitHub repos

The GhostAction supply chain attackers have moved beyond malicious GitHub Actions workflows to phishing open-source developers and delivering a credential stealer disguised as a font file. The malicious files were found in 94 GitHub repositories, according to OpenSourceMalware.

• Credential stealer disguised as a font file in GitHub repos
• 94 repositories affected in the GhostAction campaign
• Attackers phish open-source developers via workflows