The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.
The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps taken by GitHub to prevent the workflow from running.
According to the threat intelligence platform, the threat actor registered the domain “my-github[.]com” and pointed it at “193.32.204[.]199,” the same IP address that’s used as an exfiltration endpoint for data harvested from running the malicious workflow.
Read more: thehackernews.com
