GhostAction Operators Embed Credential Stealer in Font Files Across 94 GitHub Repositories

The campaign, tracked as GhostAction, involved uploading malicious font assets that executed PowerShell commands to harvest credentials from developer machines. Evidence from repository commit histories shows repeated use of innocuous-looking file names and metadata mimicking legitimate font packages. GitHub's own dependency graphs and commit logs provide the primary trail confirming the scale at 94 repos, many tied to active open-source projects with thousands of downstream users.

This pattern mirrors earlier supply-chain incidents such as the 2023 XZ Utils compromise and the 2021 Codecov breach, where trusted distribution points were abused rather than direct endpoint attacks. The choice of font files as a vector exploits common developer workflows that rarely scrutinize binary assets pulled during builds. Official statements from GitHub have not yet addressed whether the accounts were compromised or newly created, leaving the initial access method unresolved.

Independent analysis of the payload shows overlaps with prior credential-harvesting families but with enhanced evasion via font format parsing. Procurement records and job postings from affected maintainers indicate limited resources for supply-chain vetting. Next steps likely include expanded GitHub scanning for similar artifacts and potential takedown of the actor's distribution accounts within the next two weeks.