← Actors

GhostAction

Intel Library

GhostAction

Threat actor0 reports from 0 vendors

Software supply chain campaign and its unnamed operator, first reported by GitGuardian in September 2025: malicious GitHub Actions workflows named "Github Actions Security" injected into compromised repositories exfiltrated CI/CD secrets, with 3,325 secrets stolen from 817 repositories. In October 2026 OpenSourceMalware reported a renewed wave and a second stage that no longer needs a CI runner: a .vscode/tasks.json launcher with a folderOpen trigger runs a Node.js credential stealer disguised as public/fonts/fa-solid-400.woff2, installs a cron job polling the operator's server, and is backed by a fallback workflow. OpenSourceMalware calls this stage a copycat of the DPRK PolinRider technique rather than an extension of it, and ties it to GhostAction through shared server infrastructure. A phishing kit on the lookalike domain my-github.com, harvesting credentials and silently authorizing an OAuth application with repo and workflow scopes, was reported on the same infrastructure.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

VendorName
VariousGhostAction

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names GhostAction, newest first. Open any report to see the full analysis with provenance.

    No reports in the Lore library name this actor yet.

    Threat feed IOCs (0)

    Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to GhostAction. Each row shows why it was linked and where it came from.

    No feed indicators linked to this actor yet. Feeds are checked every hour.

    Public research & publications (3)

    Open-source reports about this actor collected from MISP Galaxy.