The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.

The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running.

According to the threat intelligence platform, the threat actor registered the domain "my-github[.]com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.

The domain was registered on October 9, 2026, 17 days after "my-gitlab[.]com" was registered. It's unclear if the latter code-hosting-themed domain is operated by the same threat actor.

"It follows the same my-<code-host>.com naming pattern, making it a useful pivot, but current infrastructure does not directly connect it to GhostAction," security researcher Paul McCarty said. "They use different registrars, registrant records, Cloudflare nameserver pairs, IP addresses, ASNs, and DNS designs, and no shared certificate or account artifact has been recovered."

Since then, the "my-github[.]com" domain has been used in a phishing email impersonating a GitHub security alert to target an open-source maintainer the same day it was registered. The message, sent from "noreply@my-github[.]com," warned of a new login to their GitHub account from Moscow, Russia, and instructed them to click on a link to secure their account.

The deceptive page, per OpenSourceMalware, is said to have acted as a reverse proxy, harvesting the victim's password and two-factor authentication (2FA) code, and injected JavaScript that authorized an OAuth app with permissions to modify their workflows so as to facilitate a GhostAction-style attack.

Source link