GhostAction Hackers Infect 94 GitHub Repositories With Fake Font Malware to Steal Credentials
GhostAction attackers have compromised 94 GitHub repositories with a second-stage payload that disguises credential-stealing JavaScript as a font file. The campaign abuses Visual Studio Code tasks to execute malware on developer workstations, extending an operation previously focused on stealing secrets through malicious GitHub Actions workflows. OpenSourceMalware investigated the cluster after Jamf Threat Labs researcher Thijs […] The post GhostAction Hackers Infect 94 GitHub Repositories With Fake Font Malware to Steal Credentials appeared first on Cyber Security News .