#ghostaction

October 20, 2026

GhostAction has added reverse-proxy phishing and OAuth device authorization to its GitHub workflow attacks. A fake security alert harvested passwords and 2FA codes, then used JavaScript to authorize an OAuth flow with repo, workflow, and read:org permissions. The report also ties a credential stealer disguised as a font to 94 repositories, showing the operator adapting after GitHub disrupted its malicious Actions workflows. The Hacker News (earlier coverage) · Supply Chain, Cloud & Identity