The First 24 Hours of a Suspected GhostAction Compromise

A GhostAction alert can arrive through several different signals: a phishing report, an unexpected OAuth grant, a malicious workflow commit, or a developer machine contacting the threat IP. The first 24 hours should establish which of those signals are present and preserve enough evidence to decide whether the repository, the identity, and the workstation are separate containment problems.

OpenSourceMalware documented a second-stage chain that used .vscode/tasks.json , a fake public/fonts/fa-solid-400.woff2 payload, a cron job, and a fallback workflow. The October 26 update counted 1,230 repositories owned by 391 accounts with the full second stage and 1,279 repositories owned by 411 accounts with any tracked component.…