GhostAction Phishes Developers With Fake GitHub Alert

GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the attackers alter repository workflows. In compromised repositories, the attackers also hid a credential stealer inside a file disguised as a font.

Key findings

• Attackers registered my-github[.]com and used it to impersonate a GitHub security alert in phishing emails sent to open-source maintainers.
• The lure claimed that a new login from Moscow, Russia had occurred and urged the recipient to click a link to secure their account.
• The reverse-proxy phishing page captured GitHub passwords and 2FA codes, then silently authorized an OAuth application with repo, workflow, and read:org permissions.
• The stolen OAuth access enabled attackers to read and modify repositories and inject malicious GitHub Actions workflow files.
• A second-stage component used VS Code’s folder-open task trigger to run a credential stealer hidden as public/fonts/fa-solid-400.woff2.
• Researchers identified 94 compromised repositories belonging to 66 owners that contained the second-stage component.

Who’s being targeted

• Commonly targeted roles: Open-source maintainers, Software developers, Repository administrators, DevOps engineers, Cloud engineers, Engineering managers.
• Affected industries: Open-source software development, Technology, Cloud services, Developer tooling.
• Attack channels: email, website.
• Impersonated: GitHub Security.

Awareness takeaways

• Treat account-security messages as suspicious when the sender or link is not an official GitHub domain; navigate to GitHub directly instead of using the email link.
• Do not enter passwords or two-factor authentication codes on a login page reached through an unexpected security alert.
• Review OAuth authorization prompts carefully, especially requests for repository, workflow, or organization access, and revoke unfamiliar app access immediately.
• Developers should inspect unexpected repository files and VS Code task configurations before opening a cloned project.

Red flags to watch for

• The sender used noreply@my-github[.]com rather than an official GitHub domain.
• The message creates urgency by reporting an unfamiliar login location.
• The destination is a lookalike domain, my-github[.]com, rather than github.com.