The threat actors orchestrating the widespread GhostAction software supply chain campaign have aggressively escalated their operations. Moving far beyond their initial methodology of injecting malicious GitHub Actions workflows into compromised open-source projects, the malicious operators are now actively targeting software developers directly through sophisticated phishing schemes, automated OAuth device flow exploitation, and second-stage malware hidden within fake font files designed to achieve persistent access on victim machines.
This latest evolution of the threat, closely tracked and detailed by the threat intelligence platform OpenSourceMalware, highlights how rapidly attackers adapt their tactics when automated platform defenses disrupt their primary vectors. Security researchers emphasize that the campaign has transitioned from relying solely on compromised continuous integration (CI) runners to employing direct social engineering and device-level persistence mechanisms that bypass standard code-hosting controls entirely.
The escalation began coming to light as the threat actors registered infrastructure designed to mimic legitimate code-hosting platforms. Specifically, threat intelligence telemetry revealed the registration of the domain "my-github[.]com" on October 9, 2026. This newly minted domain was promptly pointed to the IP address 193.32.204[.]199, which security analysts immediately recognized as the exact exfiltration endpoint previously utilized by the GhostAction workflows to siphon harvested sensitive data.
This registration occurred just 17 days after the creation of a similar domain, "my-gitlab[.]com." While researchers have noted the parallel naming convention, definitive technical links between the GitLab-themed domain and the primary GhostAction operators remain unconfirmed. Security researcher Paul McCarty observed that despite the obvious thematic similarities, the infrastructure behind the domains utilizes different registrars, registrant records, Cloudflare nameserver pairings, disparate IP addresses, Autonomous System Numbers (ASNs), and unique DNS designs, with no shared security certificates or account artifacts recovered thus far.
Nevertheless, the "my-github[.]com" domain was weaponized almost immediately. On the very day it was registered, it was deployed in a targeted phishing email directed at an open-source maintainer. Dispatched from the spoofed address "noreply@my-github[.]com," the communication warned the developer of an alleged unauthorized login attempt originating from Moscow, Russia. The message urged the recipient to click an embedded link to secure their account and verify their credentials.
According to OpenSourceMalware’s analysis, the link led to a deceptive landing page acting as a reverse proxy. Rather than simply capturing a standard username and password, the page was engineered to harvest the victim’s primary credentials alongside their two-factor authentication (2FA) codes in real time. Simultaneously, the site injected malicious JavaScript designed to silently authorize a GitHub OAuth application with broad permissions.
This sophisticated mechanism leverages the GitHub OAuth device flow to request repo, workflow, and read:org scopes. By doing so, the attackers gain comprehensive read and write access to the victim’s repositories, the ability to modify critical Actions workflow files, and deep visibility into organizational memberships and associated corporate or community data. The end goal mirrors modern device-code phishing tactics: securing a reusable, long-lived API access token that can be immediately exfiltrated to the attackers’ infrastructure over TCP port 8443.
McCarty explained that the script embedded in the proxy kit programmatically retrieves device and user codes, navigates GitHub’s login interfaces, extracts the necessary form parameters from the returned HTML, and submits them automatically. By injecting the appropriate user code, locating the authorization form, appending the approval flag, and posting the submission through the victim’s authenticated proxied session, the process runs entirely transparently. The targeted developer is not required to manually type device codes or consciously click an approval button, enabling a seamless automated compromise.
By acquiring repository-scoped OAuth tokens, the threat actor secures a persistent API credential capable of automating large-scale repository manipulation. This capability aligns directly with the core mechanics of the GhostAction framework, allowing the actors to systematically enumerate repositories and inject malicious workflow files into the .github/workflows/ directory across multiple projects. Security experts warn that combining repository-scale automation with precise social engineering targeting high-privilege maintainers gives the attackers dangerous leverage over downstream users, package registries, and organizational software supply chains.
Compounding the threat, researchers have discovered that the campaign has incorporated a persistent second-stage component designed to maintain a foothold on developer workstations long after any malicious GitHub workflow has been identified, quarantined, or removed. Taking a page out of advanced state-sponsored playbooks—specifically mirroring techniques previously attributed to North Korean threat actors—the attackers have begun committing files that target local development environments, most notably Visual Studio Code.
This technique forces vulnerable developer machines to automatically execute an embedded credential stealer. Beyond harvesting local data and environment variables, the component installs a persistent cron job designed to execute attacker-supplied code every five minutes. The stolen data is subsequently exfiltrated over plain HTTP on port 8080 to the same infrastructure controlling the broader campaign. Investigations have identified at least 94 compromised repositories harboring this second-stage persistence mechanism.
Parallel to the introduction of workstation-level malware, the attackers updated their CI workflow scripts. The revised workflows feature expanded credential-scraping logic designed to search for a wider variety of sensitive API keys and tokens. Furthermore, they incorporate a resilient fallback mechanism that automatically uploads harvested findings to a secret GitHub gist in the event that primary HTTP exfiltration attempts fail.
An analysis of the affected repositories reveals that the impact is spread across 66 distinct owners, with 15 accounts having already deleted, renamed, or privatized their projects following public disclosures. Among the repositories that remain publicly accessible, a significant portion appear to be largely abandoned projects. Records indicate that many had gone dormant for extended periods, with some leaving untouched codebases uncommitted for over a year, and at least one repository showing no activity for more than nine years.
The timing of these tactical shifts appears directly tied to platform enforcement. OpenSourceMalware noted that on October 9, GitHub initiated active measures to prevent the original malicious workflows from executing, resulting in subsequent waves of automated attacks failing to extract secrets. The deployment of workstation-level launchers arrived just six days later, representing a strategic pivot toward attack vectors that operate entirely outside the reach of cloud-based code-hosting controls.
Security analysts emphasize that mitigating this multi-layered threat requires immediate and comprehensive remediation. Developers who suspect compromise are advised to revoke all active GitHub access tokens and authorizations from a known clean device, immediately update account passwords, thoroughly audit repository contents, and rotate every credential or secret that the compromised workflows could potentially reach. Furthermore, maintainers are urged to notify downstream users who may have cloned affected repositories during the window of exposure.
Despite the broad scope and sophisticated automation of the campaign, security researchers have noted notable operational shortcomings that suggest the threat actors may still be maturing their capabilities. Jenn Gile, co-founder of OpenSourceMalware, pointed out that the underlying stealer’s environment-variable filter routinely misses critical API keys, its home-directory search functionality is prone to timing out and discarding valuable results, and the infrastructure relies on a single IP address to handle disparate tasks including data exfiltration, phishing campaigns, and noisy internet scanning. It was precisely this operational overlap and lack of infrastructural hygiene that allowed security platforms to trace and track the ongoing infections across the open-source ecosystem.
