Hackers hid password-stealing malware in a fake font file on GitHub

A group known for sneaking harmful automation into GitHub projects has changed tactics. Researchers at OpenSourceMalware report that it now phishes open-source developers directly and plants a password-stealing program disguised as a font file. The malware was found in 94 GitHub repositories. GitHub is a site where programmers store and share code.

What changed

The group is tracked as GhostAction. Before, it slipped harmful automated steps, called workflows, into hacked projects. Those steps ran on GitHub and hunted for secrets such as passwords and access keys. On October 9, GitHub began stopping that workflow from running. Six days later, the attackers added a second stage that does not need GitHub to run anything.

That second stage lands on a developer's own computer. A task in the code editor VS Code is set to run the stealer automatically. It also sets up a job that runs attacker-supplied code every five minutes. The researchers say it keeps working even after the harmful workflow is removed.

How the phishing works

The attackers registered a fake domain, my-github[.]com, on October 9, 2026. The same day, a maintainer got an email posing as a GitHub security alert about a suspicious login from Moscow. The link led to a copy of the login page that passed everything through to the real GitHub. It captured the password and the two-factor code. Hidden code then approved an app giving the attackers wide access to the person's repositories and workflows, with no extra click from the victim.

Who it affects

Developers and maintainers are the direct targets. Businesses are affected if their websites, portals or tools rely on code from GitHub, because a stolen developer login can open a path into that code. The 94 repositories belong to 66 owners. Fifteen have since been deleted, renamed or made private. Of the 79 still reachable, 65 had no update in over a year, so many look abandoned.

People who never touch GitHub, and those who only visit websites, are not described as targets in the report. The risk centers on anyone who logs in to GitHub or copies code from it.

What to watch for

• Security alerts that push you to click a link instead of visiting GitHub yourself.
• Web addresses that look close to the real one, such as my-github[.]com.
• Unexpected font files, or code projects that ask to run tasks when opened.

The steps in the alert box above cover what to do now. One point to add: this kit captured two-factor codes, so two-factor login helps but does not replace checking the address before you sign in.

What is not known

Nobody knows who runs the campaign. OpenSourceMalware says the work suggests limited experience, and one slip is that a single server handles several jobs, which makes infections easier to find. A second fake domain, my-gitlab[.]com, follows a similar pattern, but there is no evidence it belongs to the same group. The researchers also cannot say whether GitHub's block caused the new tactic.