The operator behind GhostAction, a campaign that steals secrets through malicious GitHub Actions workflows, has started phishing open-source developers and planting a credential stealer disguised as a font file in 94 GitHub repositories, according to research from OpenSourceMalware reported by The Hacker News on Monday, Oct. 19.

GitGuardian first documented GhostAction as a supply-chain campaign that uses compromised GitHub accounts to inject workflows into every repository those accounts can modify. The workflow, disguised as a “security audit,” sends the repository’s secrets and any credentials found in its git history to the attacker’s server. GitHub started preventing that workflow from running on Oct. 9, and waves on Oct. 10 and 12 extracted no secrets, OpenSourceMalware said.

A lookalike GitHub login

The attacker registered my-github[.]com on Oct. 9 and pointed it at 193.32.204[.]199, the same server that receives data harvested by the malicious workflows.…