GhostAction Adds Font Stealer and Silent OAuth Device Flow to Bypass GitHub Workflow Blocks

The campaign now plants three files in targeted repositories: a tasks.json with runOn:folderOpen, a malicious public/fonts/fa-solid-400.woff2 payload, and supporting scripts. This persists after malicious workflow files are removed and executes on developer workstations when the repo is opened in VS Code. OpenSourceMalware observed the pattern across 94 repositories after the domain registration. The same IP previously handled exfiltration from injected GitHub Actions workflows.

Paul McCarty's analysis shows the phishing page acts as a reverse proxy that intercepts login, 2FA, and automatically approves the OAuth application without user interaction. The resulting token carries repo, workflow, and read:org scopes, allowing continued enumeration and injection even after GitHub disabled direct workflow execution from compromised accounts. Infrastructure differs from my-gitlab[.]com in registrar, ASN, and certificate details, indicating deliberate compartmentalization.

The operation mirrors documented North Korean supply-chain tradecraft but targets open-source maintainers rather than specific vendors. By combining stolen OAuth tokens with local persistence, the actors create a durable foothold that survives repository cleanup. This raises the bar for detection because the initial compromise vector is now social engineering rather than solely workflow modification.

GitHub must expand device-code flow logging and VS Code task.json telemetry. Maintainers should audit .github/workflows and tasks.json files in all cloned repositories. Expect additional my-<host>.com domains and refined reverse-proxy kits within the next 30 days.