---
title: GhostAction escalates: phishing maintainers via my-github[.]com and planting a VS Code 'fake font' stealer in 94 repos (after ~1,900 accounts pushed secret-stealing workflows to 30,000+ repos) | ctxsec
url: https://ctxsec.com/items/ghostaction-oct-2026-wave
description: ""
status: "confirmed (GitGuardian / OpenSourceMalware research), ongoing, last updated Oct 19, 2026, ~7:55 PM ET"
published: 2026-10-19
updated: 2026-10-19T19:55:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ghostaction-oct-2026-wave.md)

confirmed (GitGuardian / OpenSourceMalware research), ongoing

2026-10-19 · updated

Oct 19, 2026, ~7:55 PM ET

### GhostAction escalates: phishing maintainers via my-github[.]com and planting a VS Code 'fake font' stealer in 94 repos (after ~1,900 accounts pushed secret-stealing workflows to 30,000+ repos)

**Update Oct 19:** OpenSourceMalware reports that GhostAction has moved past CI workflows. The lookalike domain `my-github[.]com` (registered Oct 9) resolves to the GhostAction collector `193.32.204[.]199`. It was used in a personalised fake "[GitHub] New sign-in from Moscow, Russia" email to an open-source maintainer. The linked page reverse-proxied GitHub, captured the password and 2FA code, and silently approved a GitHub OAuth device flow with `repo`, `workflow` and `read:org` scopes, sending the token to my-github[.]com:8443. A related watchlist domain, `my-gitlab[.]com` (registered Sep 22), isn't proven to be the same operator. Separately, Jamf's Thijs Xhaflaire found a 'stage 2' in 94 repositories. It's a `.vscode/tasks.json` task labelled `eslint-check` set to `runOn: folderOpen`, which runs `public/fonts/fa-solid-400.woff2` as plain Node.js. That script steals AWS, PyPI, npm, git, netrc, Claude, Gemini and kube credentials plus SSH keys, POSTs them to the same IP on port 8080, and installs a `#ghc2` cron job that fetches and runs a script every 5 minutes. Stage 2 copies North Korea's PolinRider launcher, but OpenSourceMalware labels it a copycat, not DPRK. A second fallback workflow (`lint.yml`, `ci-check.yml`, `build-check.yml`, `repo-health.yml`, `audit.yml`, `code-review.yml`, `test-suite.yml`) can exfiltrate to a secret gist. **If you opened an affected repo in VS Code:** remove the cron entry, rotate everything listed, and revoke GitHub tokens and OAuth apps from a clean device.

Earlier (Oct 13):GitGuardian's Oct 13 update says the GhostAction GitHub Actions campaign spiked Oct 8–9, using about 1,900 compromised GitHub accounts to push malicious workflows into more than 30,000 repositories across about 3,000 users and orgs, attempting to extract 3,174 secrets from CI. The new payload (workflow named "Security Audit") also greps the working tree and full git history for AWS keys, GitHub/GitLab PATs, AI provider keys and other cloud secrets, then POSTs them over plain HTTP to 193.32.204.199. GitHub began blocking the workflow from running on Oct 9, so waves on Oct 10 and 12 extracted nothing. An earlier Aug 31–Sept 30 wave hit 772 repos. GitGuardian notes many victims were hit in earlier waves too and that leaked GitHub credentials are being reused by several unrelated actors, so rotate the exposed secrets and revoke the GitHub credential used for the injection.

Sources: [OpenSourceMalware: fake-font stage 2 (Oct 19)](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file) · [OpenSourceMalware: phishing campaign](https://opensourcemalware.com/blog/ghostaction-phishing-campaign) · [OpenSourceMalware: infrastructure escalation](https://opensourcemalware.com/blog/ghostaction-attack-escalates) · [GitGuardian research](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/) · [Socket analysis](https://socket.dev/blog/ghostaction-cloud-credentials) · [StepSecurity](https://www.stepsecurity.io/blog/ghostaction-returns)