The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.

The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps



Source: TheHackerNews
Source Link: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html