GhostAction attackers phish GitHub maintainers from noreply@my-github.com fake security alerts
OpenSourceMalware says GhostAction attackers registered my-github.com and sent fake GitHub security alerts from noreply@my-github.com to steal maintainers' passwords, 2FA codes and OAuth tokens, The Hacker News reports. GitHub isn't involved.
- First reported
- Reports
- 1
Source: thehackernews.com · published
What happened
The Hacker News reported on 19 October 2026, citing threat intelligence platform OpenSourceMalware, that the threat actor behind the GhostAction supply-chain attack registered the domain my-github.com on 9 October 2026 and pointed it at 193.32.204.199, the same IP address used as an exfiltration endpoint for data stolen by its malicious GitHub Actions workflows. The same day it was registered, the domain was used in a phishing email impersonating a GitHub security alert, sent from noreply@my-github.com, that warned an open-source maintainer of a new login from Moscow and told them to click a link to secure their account. The page acted as a reverse proxy that harvested the victim's password and two-factor code and silently authorised a GitHub OAuth device flow with repo, workflow and read:org scopes, with the token exfiltrated to my-github.com on TCP port 8443. The campaign also planted a credential stealer disguised as a font file (public/fonts/fa-solid-400.woff2) launched by a VS Code tasks.json in 94 repositories. GitHub is the impersonated brand, not the scammer. The report says a similarly named domain, my-gitlab.com, is not directly connected to GhostAction.
Second stage
According to OpenSourceMalware, the second-stage component committed three files to compromised repositories: a VS Code tasks.json with a "runOn: folderOpen" trigger, a fake font file containing a stealer that harvests AWS keys, PyPI and npm tokens, Git logins, Kubernetes credentials, SSH private keys and AI provider credentials, and a backup GitHub Actions workflow in case the stealer never runs. Opening the folder in VS Code runs the stealer, which also installs a cron job that runs attacker-supplied code every five minutes. OpenSourceMalware says GitHub began preventing the malicious workflow from running on 9 October, and the launcher arrived six days later.
Advice
The researchers advise developers to revoke GitHub access and tokens from a clean device, change their passwords, audit their repositories, rotate every credential the workflows can reach, and alert users who have cloned affected repositories.
Source
The Hacker News, "GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories" (19 October 2026), citing OpenSourceMalware.
Red flags
- A 'GitHub' security alert sent from a domain other than github.com, such as my-github.com.
- A warning about a new sign-in from an unexpected location with a link to 'secure your account'.
- A login page that asks for your password and 2FA code outside github.com.
- Unexpected .vscode/tasks.json, font files or new workflow files committed to your repositories.
If you were targeted
- 1Don't click links in security alerts; open github.com yourself and check your security log.
- 2If you entered credentials, revoke tokens and OAuth app authorisations from a clean device and change your password.
- 3Audit your repositories for unfamiliar workflows, tasks.json files and font files, and rotate any secrets they could reach.
- 4Block my-github.com and 193.32.204.199 on your network.
- 5Tell users who cloned an affected repository, and report the phishing to GitHub.