Executive Summary
GhostAction attackers reportedly planted a credential stealer disguised as a font across 94 GitHub repositories after previously injecting malicious GitHub Actions workflows. Organizations that depend on GitHub repositories, open-source components, or CI/CD workflows for AI systems should review their software supply-chain controls.
What Happened
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Affected Products
- GitHub repositories
- GitHub Actions
Vulnerability / Attack Technique
Software supply-chain compromise and credential-stealing malware delivery
Technical Mechanism
The attackers reportedly injected malicious GitHub Actions workflows into compromised projects, then phished open-source developers and delivered a stealer disguised within a fake font file. The summary does not specify the malware's exact execution or credential-exfiltration mechanism.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
AI agents and LLM applications often depend on open-source repositories, automation workflows, and package-delivery pipelines, so a compromised project can introduce risk before deployment. Teams should connect repository and CI/CD inventories to AI asset inventories and test whether malicious workflow changes or developer phishing could reach production AI systems.
Recommended Controls
- Maintain an inventory of GitHub repositories, GitHub Actions workflows, and open-source dependencies used by AI applications and agents.
- Require code review and protected branches for workflow-file changes, with least-privilege permissions for GitHub Actions.
- Use dependency and repository security scanning to detect unauthorized workflow changes and suspicious files.
- Enforce phishing-resistant multifactor authentication for maintainers and restrict repository write access.
- Generate and review an SBOM covering AI application dependencies, CI/CD components, and third-party repositories.
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-20.