{"id":3605,"date":"2026-10-19T14:31:18","date_gmt":"2026-10-19T14:31:18","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3605"},"modified":"2026-10-19T14:31:18","modified_gmt":"2026-10-19T14:31:18","slug":"ghostaction-attackers-plant-credential-stealer-disguised-as-font-in-94-github-repositories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3605","title":{"rendered":"GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories"},"content":{"rendered":"<p><br \/>The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.<\/p>\n<p>The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3606,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,459,2519,3837,3788,71,2051,1738,478],"class_list":["post-3605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-credential","tag-disguised","tag-font","tag-ghostaction","tag-github","tag-plant","tag-repositories","tag-stealer"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3605"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3605\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3606"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}