GhostAction Hackers Booby-Trap 94 GitHub Repos to Steal Developers’ Credentials
Attackers linked to the GhostAction campaign hid a credential stealer as a font file in 94 GitHub repositories, triggering when projects open in Visual Studio Code and putting developers’ passwords and tokens at risk.
Developers cloning code from GitHub now have to worry that the project itself may be rigged to rob them of their secrets.
A threat group tracked as GhostAction has compromised at least 94 GitHub repositories with a malicious payload disguised as a font file, according to public technical reporting. When a developer opens one of the altered projects in Microsoft’s Visual Studio Code editor, the malware runs, harvests credentials from the machine and sets itself up to keep siphoning data.
GitHub repositories sit at the centre of how software is shared and updated, and Visual Studio Code is widely used. By blending into those tools, GhostAction aims to get its code running inside networks that also hold access keys for cloud services, internal tooling and production systems.
The credential stealer is designed to grab valuable authentication data, including passwords, API tokens and other secrets that developers often store on their workstations. Once exfiltrated, those credentials can be used to move into corporate systems, cloud accounts or other software supply-chain assets, extending the damage well beyond one infected laptop.
For individual engineers, the fallout can range from stolen personal accounts to being the starting point of a major breach. For companies, especially in sectors that rely heavily on GitHub-based workflows, the risk is that attackers quietly gain the privileges of trusted insiders.
GhostAction’s approach fits a wider trend of targeting the software development process itself. Instead of only going after corporate networks from the outside, attackers are planting malicious files in shared codebases and waiting for the most valuable victims – often highly privileged developers – to open them.
The immediate tests of resilience will come from how quickly maintainers audit and clean their repositories, whether Visual Studio Code and security tools ship dedicated detections, and whether any large breaches are eventually traced back to these tampered projects. Stronger checks on third-party code, and stricter handling of developer credentials, will be key signals that organisations are taking the threat seriously.
Sources
- OSINT