GhostAction Exploits GitHub Repositories with Credential Stealer Disguised as Font File

The GhostAction threat actor has begun distributing a credential stealer malware disguised as a font file within 94 GitHub repositories. This marks an evolution in their tactics, targeting open-source developers through deceptive supply chain methods.

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.

The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps

Read original article