{"id":"thehackernews-bdcf728a9e2a","seq":2933,"kind":"news","title":"GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories","url":"https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html","permalink":"https://vulnpulse.app/items/thehackernews-bdcf728a9e2a","summary":"The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps","severity":null,"techs":["github","actions"],"cves":[],"tags":[],"source":{"id":"thehackernews","name":"The Hacker News"},"published_at":"2026-10-19T13:05:45.000Z","fetched_at":"2026-10-21T16:17:48.024Z"}