The GhostAction operator has moved beyond malicious GitHub Actions workflows: OpenSourceMalware found a my-githubcom phishing kit that grabs passwords, 2FA codes and OAuth tokens, plus a credential stealer disguised as a font file in 94 repositories that…
