GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The GhostAction attackers have updated their tactics to include delivering a credential stealer disguised as a font file. This malware is being distributed through compromised GitHub projects. The attackers previously focused on injecting malicious GitHub Actions workflows to phish open-source developers. The evolution of their methods suggests the attackers are adapting in response to mitigation efforts. The malicious font file has been found in 94 GitHub repositories. The threat actor's refined approach indicates a continued effort to target open-source developers.