94 GitHub Repos Hit: Stealer Hidden in Fake Fonts

Emily Davis · 2026-10-19

You know how supply chain attacks usually go, right? Someone sneaks malicious code into a popular library, and the damage spreads from there. Well, the crew behind GhostAction just switched things up. They're now going after open-source developers directly, and they're using a trick that's almost too simple to spot. According to OpenSourceMalware, the attackers have moved beyond injecting malicious GitHub Actions workflows into compromised projects. Now they're phishing developers and delivering a credential stealer that's disguised as a font file. Yep, a font. The thing you'd never think twice about installing. ### From Workflows to Phishing: A Tactical Shift At first, GhostAction was all about poisoning GitHub Actions workflows. That approach worked, but it required getting into a project's codebase. The new method? It's more personal. The attackers are sending phishing emails that look like legitimate collaboration requests. Once a developer takes the bait, they're tricked into downloading a "font" that's actually malware. This shift tells us something important: the bad guys are adapting. They're not just throwing spaghetti at the wall. They're watching what works and what doesn't, and they're refining their playbook. And honestly, it's working. ### Why Fonts Are the Perfect Disguise Think about it. When was the last time you questioned a font file? Probably never. Fonts are those harmless little files that make your text look pretty. They don't execute code, right? Wrong. Font files can be weaponized, and that's exactly what's happening here. The stealer hidden inside this fake font is designed to grab credentials—passwords, tokens, anything valuable. And because it's disguised as a font, it can slip past security tools that aren't looking for that kind of threat. It's a clever move, and it's catching people off guard. ### What This Means for the Open-Source Community Open-source developers are already on high alert. They have to be. But this attack shows that even the most vigilant among us can be fooled. Phishing emails are getting better. They look real. They sound real. And when they come with a seemingly innocent attachment, it's easy to let your guard down. > "The attackers are actively refining their modus operandi in response to steps taken by the community to defend against their previous tactics." — OpenSourceMalware That's the thing about these threat actors. They don't just give up when one door closes. They find another way in. ### How to Protect Yourself So what can you do? Here are a few practical steps: - **Be skeptical of unexpected attachments.** Even if it's just a font, question it. Especially if it comes from someone you don't know. - **Verify the sender.** Phishing emails often mimic real addresses. Double-check the actual email address, not just the display name. - **Use antidetect browsers for sensitive work.** Tools like antidetect browsers can help isolate your browsing environment and reduce the risk of credential theft. - **Keep your software updated.** Security patches matter. They close the holes attackers rely on. - **Educate your team.** If you work with others, make sure everyone knows about these tactics. A little awareness goes a long way. ### The Bottom Line GhostAction's latest move is a reminder that supply chain attacks aren't just about code anymore. They're about people. They're about trust. And they're about finding the cracks in our defenses—even if those cracks are as small as a font file. Stay safe out there. And the next time you see a font file you didn't expect, maybe think twice before clicking.