GhostAction adds credential stealer in 94 compromised GitHub repositories

GhostAction attackers have added a credential-stealing component to 94 compromised GitHub repositories, OpenSourceMalware reports. Unlike the campaign's malicious GitHub Actions workflows, the new launcher can execute on developer machines when a project folder opens in Visual Studio Code. A task configuration launches malware disguised as a font file. It targets cloud keys, package-registry tokens, SSH private keys and AI-provider credentials, and installs a scheduled job that runs attacker-supplied code every five minutes. The component arrived six days after GitHub began blocking the malicious workflow. Researchers caution that this timing does not establish that the block caused the change.