GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

OpenSourceMalware reports a cluster of 94 compromised repositories with a second stage that autoruns a credential stealer and installs a cron job, hiding the stealer in a fake font file. The activity is described as a copycat of the GhostAction campaign.