GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
According to the threat intelligence platform, the threat actor registered the domain " my-github[.]com " and pointed it at " 193.32.204[.]199 ," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.
The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running.
To make matters worse, the campaign has also been observed incorporating a second-stage component that persists on developer machines even after the malicious workflow has been removed.
The fake login page also includes JavaScript to silently authorize a GitHub OAuth device flow with repo, workflow, and read:org scopes , granting it broad permissions to read/write repositories, modify Actions workflow files, and gain visibility into organization membership and related organizational data.
The deceptive page, per OpenSourceMalware, is said to have acted as a reverse proxy, harvesting the victim's password and two-factor authentication (2FA) code, and injected JavaScript that authorized an OAuth app with permissions to modify their workflows so as to facilitate a GhostAction-style attack.
The idea is the same as device code phishing , where the end goal is to obtain an access token from GitHub and exfiltrate it to "my-github[.]com" on TCP/8443.
Specifically, the approach takes a leaf out of North Korea's playbook by committing three different files - This causes VS Code to auto-run the credential stealer, which, besides collecting data, installs a cron job that runs attacker-supplied code every five minutes.
Furthermore, the permissions granted through the stealthy OAuth authorization are consistent with GhostAction's ability to enumerate repositories and inject malicious workflow files under ".github/workflows/." "The actor can now combine repository-scale automation with individual social engineering against people whose accounts provide access to projects, organizations, registries, and downstream users," OpenSourceMalware said.
We can say the operator moved to a place GitHub's controls don't reach." To mitigate the threat, developers should revoke GitHub access and tokens from a clean device, change their passwords, audit their repositories, rotate every credential the workflows can reach, and alert users who have cloned the repositories.
What happened
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
According to the threat intelligence platform, the threat actor registered the domain " my-github[.]com " and pointed it at " 193.32.204[.]199 ," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.
What changed
The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running.
To make matters worse, the campaign has also been observed incorporating a second-stage component that persists on developer machines even after the malicious workflow has been removed.
Who is affected
The fake login page also includes JavaScript to silently authorize a GitHub OAuth device flow with repo, workflow, and read:org scopes , granting it broad permissions to read/write repositories, modify Actions workflow files, and gain visibility into organization membership and related organizational data.
The deceptive page, per OpenSourceMalware, is said to have acted as a reverse proxy, harvesting the victim's password and two-factor authentication (2FA) code, and injected JavaScript that authorized an OAuth app with permissions to modify their workflows so as to facilitate a GhostAction-style attack.
Why it matters
The idea is the same as device code phishing , where the end goal is to obtain an access token from GitHub and exfiltrate it to "my-github[.]com" on TCP/8443.
Specifically, the approach takes a leaf out of North Korea's playbook by committing three different files - This causes VS Code to auto-run the credential stealer, which, besides collecting data, installs a cron job that runs attacker-supplied code every five minutes.
Technical details
Furthermore, the permissions granted through the stealthy OAuth authorization are consistent with GhostAction's ability to enumerate repositories and inject malicious workflow files under ".github/workflows/." "The actor can now combine repository-scale automation with individual social engineering against people whose accounts provide access to projects, organizations, registries, and downstream users," OpenSourceMalware said.
We can say the operator moved to a place GitHub's controls don't reach." To mitigate the threat, developers should revoke GitHub access and tokens from a clean device, change their passwords, audit their repositories, rotate every credential the workflows can reach, and alert users who have cloned the repositories.
This kit goes further by automating the user-code and authorization steps through the reverse-proxied session." By stealing a repository-scoped OAuth token, it gives the attacker a reusable API credential.
Response
Stage 2 adds a launcher that doesn't need a runner at all, and it arrived six days after the block.
What remains unknown
It's unclear if the latter code-hosting-themed domain is operated by the same threat actor.
Attribution
The Hacker News: The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.