# GhostAction adds credential stealer in 94 compromised GitHub repositories

_Published Monday, October 19, 2026 at 9:51 AM EDT · Security · Latest · Tier 2 — Notable_

![GhostAction adds credential stealer in 94 compromised GitHub repositories — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtAKfaW5dHhlv9lpzzAju1Cm_EjO4wOkhGQEMspSKCVFUCA_eaanAXGHkb-Dv3c9zSXWHW45I50Fp_bqX6ydaNlPWixkd39bl4IOeYv8xQ0oviE4d6SZcQmQ27ztf-tVV7BozEDeFYi2Fde0LpJAJ9gTHUGSOvc46MtgawesAd5-wljApeBpLyUYnczZnR/s1700-nu-rw-lo-l85-e365/git-font.jpg)

GhostAction attackers have added a credential-stealing component to 94 compromised GitHub repositories, OpenSourceMalware reports. Unlike the campaign's malicious GitHub Actions workflows, the new launcher can execute on developer machines when a project folder opens in Visual Studio Code.

A task configuration launches malware disguised as a font file. It targets cloud keys, package-registry tokens, SSH private keys and AI-provider credentials, and installs a scheduled job that runs attacker-supplied code every five minutes. The component arrived six days after GitHub began blocking the malicious workflow. Researchers caution that this timing does not establish that the block caused the change.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html)

---
Canonical: https://techandbusiness.org/newswire/WB3aq2S_BoRnx6NnftnKmp
Published: 2026-10-19T13:51:12.000Z
Story chronology: 2026-10-19T13:05:45.000Z
Retrieved: 2026-10-19T18:28:42.615Z
Publisher: Tech & Business (techandbusiness.org)