The threat actor orchestrating the sophisticated "GhostAction" supply chain attacks has significantly evolved their tactics, moving beyond the automated injection of malicious GitHub Actions workflows. According to recent findings from threat intelligence platform OpenSourceMalware, the attackers are now actively engaging in targeted phishing campaigns against open-source developers and utilizing deceptive second-stage components—including credential-stealing malware disguised within fake font files—to maintain persistent access to compromised environments.
This latest evolution marks a notable escalation in the campaign, appearing to directly coincide with countermeasures deployed by GitHub to block malicious runner execution. The shift demonstrates an adaptable adversary capable of pivoting strategies when traditional pipeline exploitation methods face platform-level restrictions.
The Infrastructure Pivot: From Code-Hosting Domains to Phishing Operations
Security researchers discovered that the threat actor behind GhostAction registered the domain "my-github[.]com" on October 9, 2026, routing it to the exact same IP address (193.32.204[.]199) utilized as the data exfiltration endpoint for harvests gathered via running malicious workflows. This registration occurred just 17 days after the registration of a similarly themed domain, "my-gitlab[.]com."
While "my-gitlab[.]com" follows a consistent naming pattern mirroring popular code hosting platforms, security analysts note that current technical infrastructure does not directly link it to the core GhostAction threat actor. According to security researcher Paul McCarty, the GitLab-themed domain utilizes distinct registrars, registrant records, Cloudflare nameserver pairs, Autonomous System Numbers (ASNs), and DNS designs, with no shared cryptographic certificates or account artifacts recovered thus far to confirm common ownership.
However, the "my-github[.]com" domain was weaponized almost immediately. On the very day it was registered, the domain was leveraged in a targeted phishing email directed at an open-source maintainer. Dispatched from the address "noreply@my-github[.]com," the deceptive message claimed to originate from GitHub security personnel, warning the recipient of an unauthorized login attempt originating from Moscow, Russia. The email urged the developer to click an embedded link to secure their account and verify their credentials.
Automated Device Code Phishing and OAuth Abuse
Instead of a standard credential harvesting page, the link led to a sophisticated reverse proxy designed to intercept and manipulate authentication flows. OpenSourceMalware revealed that the malicious portal successfully captured the victim’s primary password alongside their two-factor authentication (2FA) token, while simultaneously executing injected JavaScript to authorize a malicious GitHub OAuth application.
This stealthy mechanism silently automated a GitHub OAuth device flow requesting broad permissions, including repository access, workflow modification rights, and read access to organizational data. The objective mirrored modern device code phishing techniques, designed to acquire a reusable API access token and immediately exfiltrate it back to the "my-github[.]com" infrastructure over TCP port 8443.
McCarty explained that the script dynamically obtains device and user codes, loads the /login/device endpoint, extracts native GitHub HTML forms, and automatically populates the required fields. By inserting the user code, locating the authorization form, injecting the approval parameter, and executing the post request through the victim’s authenticated proxied session, the process occurs seamlessly without requiring the victim to manually enter device codes or consciously grant application access.
By securing a repository-scoped OAuth token, the threat actor obtains a persistent, reusable API credential. These elevated permissions grant the adversary the capability to enumerate repositories and inject malicious workflow files directly into .github/workflows/, effectively combining repository-scale automation with precise social engineering targeting high-privilege maintainers.
Introducing Second-Stage Persistence and Local Machine Stealers
To compound the threat, the campaign has expanded to include second-stage components capable of persisting on developer workstations even after malicious CI workflows have been identified and purged from repositories. Drawing inspiration from tactics historically observed in North Korean state-sponsored operations, the actors have been observed committing specific file packages designed to exploit local development environments.
These packages leverage integrated development environments—specifically Visual Studio Code—to automatically execute credential-stealing payloads upon opening the repository. Beyond harvesting sensitive local information, the stealer establishes a local cron job configured to run attacker-supplied code every five minutes. Harvested data is subsequently exfiltrated over plain HTTP on port 8080 to the same overarching infrastructure. Analysis by threat intelligence teams has identified at least 94 compromised repositories harboring this second-stage persistence mechanism.
Simultaneously, the attackers updated their CI workflow definitions. While the core mechanics resemble the original GhostAction routines, the revised workflows feature expanded credential-searching capabilities and incorporate a fallback mechanism designed to upload stolen data to secret GitHub gists if the primary HTTP POST exfiltration fails.
An analysis of the impacted repositories reveals that many are either dormant or abandoned. Among the 94 repositories associated with 66 distinct owners, 15 have already been deleted, renamed, or made private by their maintainers. Of the remaining accessible repositories, a significant portion had gone extended periods without activity, with some left untouched for over a year and sixty-five showing no new commits for more than twelve months.
Platform Defenses and Threat Actor Profile
Security analysts emphasize that the transition toward local persistence highlights an operational shift forced by platform security updates. Because the initial attack vector relies on GitHub’s infrastructure to execute malicious workflows, platform-level interventions implemented by GitHub on October 9 effectively disrupted subsequent exfiltration attempts, resulting in zero secrets harvested during subsequent waves on October 10 and 12.
By deploying a secondary launcher that operates independently of remote CI runners, the threat actor successfully pivoted to an execution vector outside the immediate reach of GitHub’s pipeline controls.
Despite the sophistication of the supply chain compromise, security experts note technical indicators suggesting the operators may possess limited experience or operational security discipline. Jenn Gile, co-founder of OpenSourceMalware, pointed out that the credential stealer’s environment-variable filtering mechanism frequently overlooks vital API keys, and home-directory searching routines occasionally time out, resulting in discarded search results. Furthermore, the reliance on a single IP address to handle disparate functions—including data exfiltration, phishing, and noisy internet scanning—has left clear digital footprints that continue to facilitate ongoing threat hunting and infection tracking.
To mitigate ongoing risks, cybersecurity professionals advise developers to immediately revoke unauthorized GitHub access tokens and application grants from a clean, uncompromised device. Recommended remediation steps also include updating passwords, conducting comprehensive repository audits, rotating all credentials potentially exposed to compromised workflows, and notifying downstream users who may have cloned affected projects.
