---
title: Hunt: GhostAction workflows, VS Code folderOpen 'fake font' stage 2, #ghc2 cron, and my-github[.]com phishing (exfil 193.32.204.199) | ctxsec
url: https://ctxsec.com/items/hunt-ghostaction-workflows
description: ""
status: "hunt idea (GitGuardian + OpenSourceMalware IoCs), last updated Oct 19, 2026, ~7:55 PM ET"
published: 2026-10-19
updated: 2026-10-19T19:55:00-04:00
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-ghostaction-workflows.md)

hunt idea (GitGuardian + OpenSourceMalware IoCs)

2026-10-19 · updated

Oct 19, 2026, ~7:55 PM ET

### Hunt: GhostAction workflows, VS Code folderOpen 'fake font' stage 2, #ghc2 cron, and my-github[.]com phishing (exfil 193.32.204.199)

**Update Oct 19 (stage 2 + phishing):** (1) In repos: `.vscode/tasks.json` with `"runOn": "folderOpen"` running `node ./public/fonts/fa-solid-400.woff2` (label `eslint-check`), plus new workflows named lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml or test-suite.yml. (2) On dev machines: crontab lines containing `#ghc2` or `curl ... http://193.32.204.199:8080/c2/`, and node processes launched by VS Code reading `.aws/credentials`, `.npmrc`, `.pypirc`, `.claude/.credentials.json` or `.gemini/oauth_creds.json`. (3) Egress: HTTP to 193.32.204.199 on ports 80, 8080 and 8443, and DNS for `my-github[.]com` or `my-gitlab[.]com` and their subdomains. (4) GitHub: OAuth device-flow authorizations granting `repo`, `workflow` and `read:org` to unknown apps (check Settings → Applications → Authorized OAuth Apps and org audit logs).

Earlier (Oct 15):Across your GitHub orgs, search for workflow files and commits matching GhostAction: workflow names "Security Audit", "Github Actions Security" or "Security Check"; files `github_actions_security.yml`, `security-audit.yml`, `security-check.yml`; commit messages "Add Github Actions Security workflow" / "Update Github Actions Security workflow"; and any `curl` POST to `193.32.204.199` (also older endpoints `170.39.218.2`, `carte-avantage.com`, `*.plesk.page`). Use the org audit log for workflow-file commits pushed via API by users who don't normally touch CI, and Actions run history for jobs that ran `git log -p --all` and grep for `AKIA`/`ASIA`. Egress logs: outbound HTTP from runners to 193.32.204.199. If found, rotate every secret the workflow referenced or could grep from history, and revoke the pushing account's PATs/SSH keys and sessions.

Sources: [OpenSourceMalware stage 2](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file) · [OpenSourceMalware phishing](https://opensourcemalware.com/blog/ghostaction-phishing-campaign) · [GitGuardian GhostAction](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/) · [Socket analysis](https://socket.dev/blog/ghostaction-cloud-credentials)