GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

Summary

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.