The GhostAction threat actors have intensified their supply chain attacks by targeting open-source developers with a credential stealer disguised as a font file. This malicious campaign has infiltrated 94 GitHub repositories, underscoring an escalation in their tactics. OpenSourceMalware, a threat intelligence platform, has outlined the latest strategies employed by these attackers.
New Tactics in Credential Theft
Initially, GhostAction’s approach involved injecting malicious workflows into GitHub Actions of compromised projects. However, they have since evolved to phishing campaigns targeting open-source developers. The attackers registered a deceptive domain, “my-github[.]com,” to impersonate GitHub and lure victims into divulging sensitive information. This domain, linked to an IP address used for data exfiltration, was established shortly after a similar “my-gitlab[.]com” domain, though no direct connection between the two has been confirmed.
Paul McCarty, a security researcher, highlighted the use of sophisticated phishing techniques. An email from “noreply@my-github[.]com” falsely alerted users to a suspicious login from Moscow, Russia. Victims who followed the email’s instructions were redirected to a fake login page designed to capture their GitHub credentials and two-factor authentication (2FA) codes.
Mechanics of the Attack
The fraudulent login page acted as a reverse proxy, enabling attackers to gain OAuth authorization. This granted them extensive permissions, such as modifying workflows and accessing organizational data. By obtaining a repository-scoped OAuth token, attackers could automate malicious activities and bypass user interventions through a reverse-proxied session.
In addition to OAuth exploitation, the attackers planted a second-stage payload on victim machines. This payload included a Visual Studio Code (VS Code) tasks.json file and a font file, “fa-solid-400.woff2,” containing a stealer designed to collect various developer credentials. This stealer mimics tactics from North Korea’s PolinRider campaign, executing automatically when a folder is opened in VS Code.
Impact and Mitigation
Despite GitHub’s recent steps to block the initial malicious workflows, the attackers have adapted by incorporating a secondary component that persists on developer machines. With 94 repositories compromised, 66 belonging to distinct owners, the majority of these repositories have been neglected for years, making them vulnerable to such attacks.
Developers are advised to revoke access and reset credentials from a secure device, thoroughly audit their repositories, and inform any users who may have cloned affected repositories. Jenn Gile from OpenSourceMalware noted that while the operators behind GhostAction seem inexperienced, their evolving techniques present an ongoing threat to the developer community.
The cybersecurity community continues to monitor the situation closely, emphasizing vigilance and proactive measures to prevent further exploitation. As the attackers refine their methods, it is crucial for developers to remain alert and implement robust security practices.
