# GhostAction phish completes a GitHub device flow, then hides a stealer in a font file

Source: https://startwithidentity.com/blog/2026-10-19-ghostaction-phish-completes-github-device-flow-then-hides-stealer-in-a-font-file/
Last updated: 2026-10-19
License: content by Start with Identity. Cite the source URL.

---

Paul McCarty of OpenSourceMalware reported on October 19 that the infrastructure behind the GhostAction GitHub campaign has added phishing and a second-stage stealer. A domain registered October 9, my-github[.]com, sent a fake GitHub alert about a Moscow login to an open-source maintainer. The page reverse-proxied the victim's password and 2FA code, and injected JavaScript completed a GitHub OAuth device flow granting `repo`, `workflow` and `read:org` scopes. McCarty says the domain is not directly tied to GhostAction, though it points at the same IP that receives stolen data. In 94 repositories across 66 owners, the operator also committed a VS Code `tasks.json` that runs on folder open, a stealer named `public/fonts/fa-solid-400.woff2`, and a backup Actions workflow. It targets AWS, npm, PyPI, Kubernetes, SSH and AI provider keys. GitHub began blocking the original workflow on October 9.

## Why it matters

The phish did not stop at a password and code. It turned a one-time login into a long-lived OAuth grant, which survives a password reset. This is [device code phishing](https://startwithidentity.com/techniques/device-code-phishing/) combined with an [adversary-in-the-middle](https://startwithidentity.com/glossary/adversary-in-the-middle/) proxy, and only [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) such as a passkey stops the proxy half.

Maintainers should review Settings, Applications, Authorized OAuth Apps for grants they did not make, revoke tokens from a clean device, and move GitHub sign-in to a passkey or security key. Search repositories for the font path and unexpected `tasks.json` files, and keep VS Code workspace trust on so opening a cloned folder does not run tasks. Rotate everything the workflows could read. Our [October 15 GhostAction post](https://startwithidentity.com/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/) covers the earlier wave.

Source: [The Hacker News](https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html)