Ethical Hacking News
The GhostAction attack is a sophisticated supply chain attack that uses phishing and credential-stealing techniques to gain access to compromised GitHub repositories. The attack is notable for its scope and sophistication, with the attackers targeting over 30,000 repositories and compromising over 1,900 GitHub accounts. To mitigate the threat, developers should take steps to secure their repositories, including revoking GitHub access and tokens, changing passwords, and rotating every credential the workflows can reach.
Over 1,900 GitHub accounts compromised and 30,000 repositories targeted by the GhostAction attack. Attackers used phishing and credential-stealing techniques to gain access to compromised repositories. Fake font file used to steal credentials from open-source developers. Second-stage component harvested AWS keys, PyPI tokens, and other credentials. Credential stealer installed a cron job to run attacker-supplied code every five minutes. Attackers uploaded stolen credentials to a server over plain HTTP on port 8080. Importance of cybersecurity awareness, regular security updates, and best practices highlighted.
The cybersecurity landscape has been witness to numerous supply chain attacks in recent years, with GhostAction being the latest in a series of sophisticated attacks that have been unfolding on GitHub repositories. According to a recent report by OpenSourceMalware, the GhostAction attackers have managed to compromise over 1,900 GitHub accounts and target over 30,000 repositories, with the attackers using a combination of phishing and credential-stealing techniques to gain access to the compromised repositories.
The GhostAction attack is notable for its sophisticated nature, with the attackers using a combination of techniques to evade detection and gain access to the compromised repositories. The attackers have managed to create a fake font file that is disguised as a legitimate font, and they have used this file to steal credentials from open-source developers. The fake font file is used to phishing emails that impersonate GitHub security alerts, with the emails instructing the victims to click on a link to secure their account.
Once the victims click on the link, they are taken to a fake login page that is designed to harvest their credentials. The fake login page is a reverse proxy that loads the victim's forms from the GitHub login page and submits them automatically, allowing the attackers to obtain the victim's credentials without them even realizing it. The attackers have also managed to create a second-stage component that persists on the developer's machine even after the malicious workflow has been removed.
The second-stage component is a credential stealer that is designed to harvest AWS keys, PyPI tokens, npm tokens, Git logins, Kubernetes cluster credentials, SSH private keys, and AI provider credentials for Anthropic Claude and Google Gemini. The credential stealer is used to steal credentials from the compromised repositories, and it is also used to install a cron job that runs attacker-supplied code every five minutes. The collected data is sent to the same server over plain HTTP on port 8080.
The attackers have also managed to create a second GitHub Actions workflow that is activated if the infostealer never runs. This workflow is the same as the original malicious workflow, but with added credential formats to look for and a fallback that uploads findings to a secret GitHub gist if the POST fails. The second workflow is used to upload the stolen credentials to the attackers' server, where they can be used for further malicious activities.
The GhostAction attack is notable for its scope and sophistication, with the attackers targeting over 30,000 repositories and compromising over 1,900 GitHub accounts. The attack is also notable for its use of phishing and credential-stealing techniques, which are commonly used by attackers to gain access to compromised repositories.
To mitigate the threat, developers should revoke GitHub access and tokens from a clean device, change their passwords, audit their repositories, rotate every credential the workflows can reach, and alert users who have cloned the repositories. The attackers are believed to be limited in their experience, with the attackers missing most API keys and having a single IP handle exfiltration, phishing, and noisy internet scanning.
The GhostAction attack highlights the importance of cybersecurity awareness and the need for developers to be vigilant when it comes to phishing and credential-stealing attacks. The attack also highlights the importance of regular security updates and the need for developers to stay up-to-date with the latest security patches and best practices.
In conclusion, the GhostAction attack is a sophisticated supply chain attack that uses phishing and credential-stealing techniques to gain access to compromised GitHub repositories. The attack is notable for its scope and sophistication, and it highlights the importance of cybersecurity awareness and the need for developers to be vigilant when it comes to phishing and credential-stealing attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/GhostAction-Attackers-A-Sophisticated-Supply-Chain-Attack-with-Phishing-and-Credential-Stealing-Capabilities-ehn.shtml
https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
Published: Mon Oct 19 08:48:29 2026 by llama3.2 3B Q4_K_M
