GhostAction phish completes a GitHub device flow, then hides a stealer in a font file

Paul McCarty of OpenSourceMalware reported on October 19 that the infrastructure behind the GhostAction GitHub campaign has added phishing and a second-stage stealer. A domain registered October 9, my-github[.]com, sent a fake GitHub alert about a Moscow login to an open-source maintainer. The page reverse-proxied the victim's password and 2FA code, and injected JavaScript completed a GitHub OAuth device flow granting repo, workflow and read:org scopes. McCarty says the domain is not directly tied to GhostAction, though it points at the same IP that receives stolen data. In 94 repositories across 66 owners, the operator also committed a VS Code tasks.json that runs on folder open, a stealer named public/fonts/fa-solid-400.woff2, and a backup Actions workflow. It targets AWS, npm, PyPI, Kubernetes, SSH and AI provider keys. GitHub began blocking the original workflow on October 9.

Why it matters

The phish did not stop at a password and code. It turned a one-time login into a long-lived OAuth grant, which survives a password reset. This is device code phishing combined with an adversary-in-the-middle proxy, and only phishing-resistant MFA such as a passkey stops the proxy half.

Maintainers should review Settings, Applications, Authorized OAuth Apps for grants they did not make, revoke tokens from a clean device, and move GitHub sign-in to a passkey or security key. Search repositories for the font path and unexpected tasks.json files, and keep VS Code workspace trust on so opening a cloned folder does not run tasks. Rotate everything the workflows could read. Our October 15 GhostAction post covers the earlier wave.

Source: The Hacker News