The group behind the GhostAction supply-chain campaign has widened its tactics, now targeting open-source developers directly with a credential stealer concealed inside a fake font file, in addition to the malicious GitHub Actions workflows that first brought the operation to light. The campaign has been observed across 94 GitHub repositories.
The Hacker News reported on 19 October 2026 that the latest shift was documented by researchers at OpenSourceMalware, who have been tracking the operation. Their analysis describes a threat actor actively iterating on its methods — apparently in response to the defensive guidance published after the earlier phase of the campaign was disclosed.
Two attack paths, one campaign
GhostAction's original signature was the quiet injection of malicious CI/CD workflow definitions into legitimate repositories. A tampered YAML workflow could run during routine builds, then abuse its access to repository secrets to exfiltrate credentials. That technique has not been abandoned. But OpenSourceMalware's findings indicate the operators have added a second track: phishing developers with lures that deliver a stealer payload disguised as a typeface file.
The combination matters for anyone responsible for securing a development organisation. Defences aimed squarely at pipeline configuration — workflow review gates, restricted triggers, secret scoping — address only the first path. A maintainer who opens a malicious font on their own workstation, however briefly, is exposed regardless of how carefully the repository's workflows are locked down. Any incident response that audits YAML files and stops there leaves a gap open.
Why a font file works as a disguise
The effectiveness of the technique rests on a blind spot that most software supply-chain defences still do not cover. Review processes are built around code: diffs to source files, dependency manifests and build scripts are examined carefully, while binary assets such as .ttf and .otf files are rarely given the same attention. The same asymmetry applies upstream of the repository — a message proposing a typeface arrives in an inbox as a design courtesy, not as a suspected executable.
The reported scale of the operation reinforces the point. Ninety-four repositories is a footprint consistent with scripted, automated distribution rather than opportunistic, hand-delivered attacks. That also implies defenders should expect further revisions to the playbook; the techniques described this week are best read as a current snapshot of a campaign whose operators treat public research as free development input.
Practical steps for maintainers
For teams weighing their exposure, the dual-track nature of the campaign suggests a correspondingly broad set of checks:
- Review recent workflow changes across owned and upstream repositories, particularly those touching secrets or making outbound network calls.
- Audit recently added non-code assets — fonts, images, sample data — and verify their origins before use or redistribution.
- Scope CI/CD credentials tightly, preferring short-lived, environment-scoped tokens over long-lived secrets.
- Rotate any credentials exposed to repositories where suspicious workflow activity has been identified.
- Treat unsolicited font and design files with the same caution as executables, and avoid opening them on machines holding developer tokens.
- Enforce two-factor authentication across all developer and organisation accounts.
- Restrict runner execution to allow-listed workflows where the platform supports it.
The wider lesson
GhostAction illustrates a persistent reality of open-source security: disclosure does not end a campaign, it shapes its next iteration. It also underscores that repository security and developer security are no longer separate problems. In this operation they are two halves of a single strategy, and addressing either in isolation will not close it.
Source: The Hacker News, 19 October 2026, covering research published by OpenSourceMalware.
---
```yaml
---
title: "GhostAction 攻擊者轉向字型檔案藏匿憑證竊取器，波及 94 個 GitHub 儲存庫"
date: 2026-10-19T15:22:00
author: HKLUG Team
source_url: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
tags: [supply-chain, malware, github, credential-theft, open-source, ghostaction]
---
GhostAction 供應鏈攻擊背後的黑客組織已擴大其攻擊手法，除了原先引發此次行動的惡意 GitHub Actions workflows 外，現更直接鎖定開源開發者，透過偽裝成字型檔案的憑證竊取器發動攻擊。據觀察，此次攻擊行動已遍及 94 個 GitHub 儲存庫。
The Hacker News 於 2026 年 10 月 19 日報道，最新手法由持續追蹤該行動的 OpenSourceMalware 研究人員記錄。其分析顯示，威脅行為者正積極調整攻擊手段——似乎是在回應早期攻擊階段曝光後所發布的防禦指引。
兩條攻擊路徑，同一場行動
GhostAction 最初的標誌是將惡意 CI/CD workflow 定義悄悄注入合法儲存庫。被竄改的 YAML workflow 可在例行建置期間執行，隨後濫用其對儲存庫 secrets 的存取權限來外洩憑證。該手法並未被放棄。但 OpenSourceMalware 的研究結果顯示，攻擊者已加入第二條攻擊路徑：以釣魚誘餌鎖定開發者，投放隱藏在字型檔案中的竊取器 payload。
這對任何負責保護開發組織的人員而言都非同小可。針對管線配置的防禦措施——workflow 審核關卡、受限觸發條件、secret 範圍控管——只能應對第一條路徑。維護者一旦在自己的工作站開啟惡意字型檔案，無論儲存庫的 workflows 已如何妥善鎖定，都仍會暴露於風險之中。任何僅審核 YAML 檔案便止步的事件應變流程，都會遺留防護缺口。
字型檔案為何能成功偽裝
此手法的有效性取決於大多數軟件供應鏈防禦仍未涵蓋的盲點。審查流程圍繞程式碼建立：原始檔差異、依賴清單和建置腳本會被仔細檢視，但 .ttf 與 .otf 等二進制檔案很少獲得同等關注。同樣的不對稱性也存在於儲存庫上游——一封提議提供字型的電郵以設計贈禮的姿態進入收件箱，而不會被視為可疑的執行檔。
此次行動的規模也印證了這一觀點。94 個儲存庫的影響範圍與腳本化自動分發的特徵一致，而非機會性、逐一手動的攻擊。這也意味著防禦者應預期攻擊手冊會繼續更新；本週披露的技術最好被視為一場行動的當前快照——其操作者將公開研究視為免費的研發資源。
維護者的實際應對措施
考量此行動的雙軌特性，團隊評估自身暴露程度時，應採取相應的廣泛檢查：
- 檢視所屬及上游儲存庫近期的 workflow 變更，特別是涉及 secrets 或對外網絡連線的變更。
- 檢視近期新增的非程式碼資產——字型、圖片、範例資料——並在使用或再分發前確認其來源。
- 嚴格限制 CI/CD 憑證範圍，優先使用短期、環境限定的 tokens，而非長期 secrets。
- 輪替任何曾暴露於可疑 workflow 活動之儲存庫中的憑證。
- 以處理執行檔的同等審慎態度對待未經邀請的字型與設計檔案，並避免在持有開發者 tokens 的機器上開啟。
- 在所有開發者及組織帳戶上強制執行雙重認證。
- 將 runners 限制為允許清單中的 workflows（平台支持時），防止任意 workflow 定義執行並存取 secrets。
更廣泛的啟示
GhostAction 揭示了開源安全的一個持久現實：漏洞披露不會終結一場攻擊行動，而是塑造其下一輪演變。同時也印證，儲存庫安全與開發者安全已不再是兩個獨立問題。在此次行動中，它們是同一策略的兩面，僅解決其中一項無法徹底化解威脅。
資料來源：The Hacker News，2026 年 10 月 19 日，報導 OpenSourceMalware 發布的研究。
The group behind the GhostAction supply-chain campaign has widened its tactics, now targeting open-source developers directly with a credential stealer concealed inside a fake font file, in addition to the malicious GitHub Actions workflows that first brought the operation to light. The campaign has been observed across 94 GitHub repositories.
The Hacker News reported on 19 October 2026 that the latest shift was documented by researchers at OpenSourceMalware, who have been tracking the operation. Their analysis describes a threat actor actively iterating on its methods — apparently in response to the defensive guidance published after the earlier phase of the campaign was disclosed.
Two attack paths, one campaign
GhostAction's original signature was the quiet injection of malicious CI/CD workflow definitions into legitimate repositories. A tampered YAML workflow could run during routine builds, then abuse its access to repository secrets to exfiltrate credentials. That technique has not been abandoned. But OpenSourceMalware's findings indicate the operators have added a second track: phishing developers with lures that deliver a stealer payload disguised as a typeface file.
The combination matters for anyone responsible for securing a development organisation. Defences aimed squarely at pipeline configuration — workflow review gates, restricted triggers, secret scoping — address only the first path. A maintainer who opens a malicious font on their own workstation, however briefly, is exposed regardless of how carefully the repository's workflows are locked down. Any incident response that audits YAML files and stops there leaves a gap open.
Why a font file works as a disguise
The effectiveness of the technique rests on a blind spot that most software supply-chain defences still do not cover. Review processes are built around code: diffs to source files, dependency manifests and build scripts are examined carefully, while binary assets such as .ttf and .otf files are rarely given the same attention. The same asymmetry applies upstream of the repository — a message proposing a typeface arrives in an inbox as a design courtesy, not as a suspected executable.
The reported scale of the operation reinforces the point. Ninety-four repositories is a footprint consistent with scripted, automated distribution rather than opportunistic, hand-delivered attacks. That also implies defenders should expect further revisions to the playbook; the techniques described this week are best read as a current snapshot of a campaign whose operators treat public research as free development input.
Practical steps for maintainers
For teams weighing their exposure, the dual-track nature of the campaign suggests a correspondingly broad set of checks:
- Review recent workflow changes across owned and upstream repositories, particularly those touching secrets or making outbound network calls.
- Audit recently added non-code assets — fonts, images, sample data — and verify their origins before use or redistribution.
- Scope CI/CD credentials tightly, preferring short-lived, environment-scoped tokens over long-lived secrets.
- Rotate any credentials exposed to repositories where suspicious workflow activity has been identified.
- Treat unsolicited font and design files with the same caution as executables, and avoid opening them on machines holding developer tokens.
- Enforce two-factor authentication across all developer and organisation accounts.
- Restrict runner execution to allow-listed workflows where the platform supports it.
The wider lesson
GhostAction illustrates a persistent reality of open-source security: disclosure does not end a campaign, it shapes its next iteration. It also underscores that repository security and developer security are no longer separate problems. In this operation they are two halves of a single strategy, and addressing either in isolation will not close it.
Source: The Hacker News, 19 October 2026, covering research published by OpenSourceMalware.
---
```yaml
---
title: "GhostAction 攻擊者轉向字型檔案藏匿憑證竊取器，波及 94 個 GitHub 儲存庫"
date: 2026-10-19T15:22:00
author: HKLUG Team
source_url: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
tags: [供應鏈攻擊, 惡意軟件, GitHub, 憑證盜竊, 開源, GhostAction]
---
GhostAction 供應鏈攻擊背後的黑客組織已擴大其攻擊手法，除了原先引發此次行動的惡意 GitHub Actions workflows 外，現更直接鎖定開源開發者，透過偽裝成字型檔案的憑證竊取器發動攻擊。據觀察，此次攻擊行動已遍及 94 個 GitHub 儲存庫。
The Hacker News 於 2026 年 10 月 19 日報道，最新手法由持續追蹤該行動的 OpenSourceMalware 研究人員記錄。其分析顯示，威脅攻擊者正積極迭代其攻擊手法——似乎是在回應早期攻擊階段被披露後發布的防禦指引。
兩條攻擊路徑，同一場攻勢
GhostAction 最初的標誌是將惡意 CI/CD workflow 定義悄悄注入合法儲存庫。被竄改的 YAML workflow 可在例行建置期間執行，隨後濫用其對儲存庫 secrets 的存取權限來外洩憑證。該手法並未被放棄。但 OpenSourceMalware 的調查結果顯示，攻擊者已加入第二條攻擊路徑：以釣魚誘餌鎖定開發者，投放偽裝成字型檔案的竊取器 payload。
這對任何負責保護開發組織的人員而言都非同小可。針對 pipeline 配置的防禦措施——workflow 審核關卡、受限 triggers、secret 範圍控管——只能應對第一條路徑。維護者一旦在自己的工作站開啟惡意字型檔案，無論儲存庫的 workflows 已如何妥善鎖定，都仍會暴露於風險之中。任何僅審核 YAML files 便止步的事件應變措施，都會遺留防護缺口。
字型檔案為何能成功偽裝
此手法之所以有效，在於大多數軟件供應鏈防禦仍然未有覆蓋的盲點。審查流程圍繞程式碼建立：source files 的 diffs、dependency manifests 和 build scripts 都會受到仔細檢視，而 .ttf 及 .otf 等二進制檔案則很少獲得同等重視。同樣的不對稱情況亦存在於儲存庫的上游——一封提議採用某款字型的電郵，會以設計上的貼心建議身份出現在收件匣，而非被視為可疑的 executable。
已披露的行動規模進一步印證此點。94 個儲存庫的影響範圍，符合以腳本自動化分發的特徵，而非機會性的人手投放攻擊。這同時意味著防禦者應預期 playbook 會繼續演化；本週披露的技術，最好理解為這場攻擊行動的現階段快照——其操作者把公開發表的研究視為免費的開發輸入。
維護者的實務建議
對於評估自身風險的團隊，這場攻勢的雙軌性質意味著需要採取相應廣泛的檢查措施：
- 檢視所擁有及上游儲存庫近期的 workflow 變更，尤其涉及 secrets 或發出對外網絡連接的部分。
- 檢視近期新增的非程式碼資產——字型、圖片、範例資料——在使用或轉發前確認其來源。
- 嚴格限定 CI/CD credentials 的存取範圍，優先使用短期、限定 environment 的 tokens，而非長期 secrets。
- 對任何在發現可疑 workflow 活動的儲存庫中暴露過的憑證進行輪換。
- 以處理 executables 的同等審慎態度對待未經邀請的字型及設計檔案，切勿在存有 developer tokens 的電腦上開啟。
- 在所有開發者及組織帳戶上強制執行雙重認證（two-factor authentication）。
- 在平台支持的情況下，將 runners 的執行範圍限制於允許清單內的 workflows。
更廣泛的啟示
GhostAction 體現了開源安全的一個持久現實：披露並不會終結一場攻擊行動，而是塑造它的下一次迭代。它同時突顯儲存庫安全與開發者安全已不再是兩個獨立的問題。在這次行動中，兩者是同一策略的兩面，任何一方面的單獨處理都無法徹底化解威脅。
資料來源：The Hacker News，2026 年 10 月 19 日，報道 OpenSourceMalware 發表的研究。