GhostAction Uses GitHub Actions to Steal Cloud and AI Credentials

What changed · following since Oct 10 Oct 20 — GhostAction has added GitHub-themed phishing and a VS Code-triggered credential stealer disguised as a font file, with 94 repositories carrying the second stage.

GhostAction has evolved from workflow injection into a multi-stage operation that now includes GitHub-themed phishing and a VS Code-triggered stealer disguised as a font file. The shift indicates the attackers are actively refining their approach in response to GitHub's defensive measures, expanding the threat beyond CI/CD compromise to developer workstations.

• GhostAction compromised about 1,900 GitHub accounts, targeted over 30,000 repositories across 3,000 users and organizations, and attempted to extract 3,174 secrets.
• The campaign spike was observed on October 8 and 9, 2026.
• Attackers used Takashi Kitao's account to push the workflow to 27 repositories beginning at 13:20 UTC, then Henry Wu's account to reach 318 repositories in a 16-minute window from 21:10 to 21:26 UTC.
• 94 compromised repositories now carry a second-stage credential stealer disguised as a font file, triggered when opened in VS Code.
• Attackers registered the phishing domain "my-github[.]com" on October 9, 2026, pointing to the same IP used for data exfiltration.
• The evolution follows GitHub's steps to prevent the malicious workflow from running.

Bottom line Audit workflow changes, check repositories for unexpected font files or VS Code extensions, and rotate all exposed credentials including any that may have been accessed through developer workstations.