GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The actor behind the GhostAction supply chain campaign has planted a credential stealer disguised as a font file in 94 GitHub repositories, The Hacker News reports. OpenSourceMalware says the second stage runs automatically when a repository is opened in VS Code and harvests cloud keys, tokens and SSH credentials, after GitHub began blocking the campaign’s original malicious workflows.