high⚡ Early warning · no CVE yetGhostActionExploited in the wildPackage
GhostAction uses stolen GitHub tokens to plant credential-stealing workflows and a fake-font VS Code stealer in thousands of repos
The GhostAction operator uses GitHub tokens that were stolen earlier and never revoked. Between 2026-10-13 and 2026-10-21 it pushed 72,026 commits to at least 22,964 public repositories from 1,792 accounts, according to GitGuardian. The commits carry five payload families: (1) re-pointed security-audit.yml workflows; (2) seven innocuous-looking workflows that grep the repo, its history and wiki for secrets, including AI keys (sk-oat-, sk-svcacct-, gsk_, xai-); (3) self-hosted-runner workflows that read IMDS role credentials and local AWS/PyPI/npm/Docker/kube/gh/Claude/Gemini/OpenAI/Hugging Face credentials; (4) a GitHub OIDC workflow that tries to assume every AWS IAM role ARN it finds; (5) a Node.js stealer disguised as public/fonts/fa-solid-400.woff2. A hidden .vscode/tasks.json task (runOn: folderOpen) launches the stealer when a developer opens the repo in VS Code and trusts the workspace. The launcher is copied from PolinRider, a campaign originally attributed to DPRK. Three families install a cron job that fetches and runs a shell script from the C2 every 5 minutes, so cleaning the repo does not remove it. GitHub blocked the malicious workflow runs, but that does not stop the VS Code font stealer. From 2026-10-22 to 26, 188 GhostAction commits were amended and force-pushed with PolinRider loaders (multi-stage, Ethereum-resolved C2, browser and wallet stealer). Developers who opened affected repos are at risk, as are self-hosted runners and AWS accounts whose OIDC trust allows those repos. The last GhostAction commit GitGuardian saw was at 2026-10-21 04:37 UTC. Whether the two campaigns share an operator is unknown.
Summary written from the sources below. Check the originals before acting.
Known so far
5/6
high
no CVSS yet; severity from the sources
known so far5 of 6
First public
Oct 27, 2026 UTC
Last modified
Oct 27, 2026
Status
open
Known exploitation
Yes
Public exploit
None on GitHub
EPSS
not scored
First seen by InfraStack 2026-10-27 19:09 UTC. All times on this page are UTC.
Who is affected
5 products
Product
Ecosystem
Affected
Fixed in
GitHub Actions
vendor
repos pushed to with stolen tokens
–
GitHub
vendor
accounts with leaked, unrevoked tokens
–
Visual Studio Code
vendor
opening an affected repo with workspace trust
–
AWS IAM
vendor
roles trusting GitHub OIDC without repo/branch restrictions
–
GitHub Actions self-hosted runners
vendor
runners that executed the payload
–
Who cares
campaign, early-warning
Not affected if
–
How to check
On developer machines and self-hosted runners: run crontab -l and look for '#ghc2' or 'curl -s -m 10 http://193.32.204.199:8080/c2/'. Look for ~/.node_modules/.npm-ws-runner.js, .npm-ws.json and .npm-ws.pid (PolinRider). Check for connections to 193.32.204.199:8080 or 95.135.181.151:443.
In repos, on every branch: look for .vscode/tasks.json with task 'eslint-check' and runOn folderOpen, and for public/fonts/fa-solid-400.woff2, fa-solid-300.ttf or fa-solid.lkf that are actually text/JS. Look for api.js with code after a long run of whitespace, and for unexpected workflows: audit.yml, build-check.yml, repo-health.yml, lint.yml, ci-check.yml, test-suite.yml, code-review.yml, security-audit.yml, maintenance.yml, cache-cleanup.yml, runner-maintenance.yml, cleanup-job.yml, cleanup_cache.yml, github_actions_security.yml. Check for force-pushes you did not make.
On the GitHub account: look for a private gist named 'build cache' with a c.dat file.
In AWS CloudTrail: look for AssumeRoleWithWebIdentity from token.actions.githubusercontent.com with unexpected repos or branches, or session names starting 'secret'.
Delete the planted files on every branch. Do not revert 'Update' commits, because that restores the earlier malicious version.
Revoke the pushing account's PATs, OAuth app grants and SSH keys. GitGuardian saw re-infection when tokens were kept.
Rotate every secret in the repo, its history and wiki, plus all Actions secrets.
On any machine that opened an affected repo in VS Code, and on any self-hosted runner: remove the '#ghc2' cron entry and the ~/.node_modules/.npm-ws* files, then rotate all local credentials (cloud, npm/PyPI/Docker registries, AI tool keys, SSH, kube, browser sessions).
Restrict AWS OIDC trust policies to specific repos and branches, and require approval for workflow changes.
Keep VS Code Workspace Trust on; do not trust freshly cloned repos that carry folderOpen tasks.
Who had it, and when
1 source
InfraStack analyst2026-10-27 19:09 UTC · published 2026-10-27 00:00 UTC
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
What people are saying
1 post from accounts we follow · first mention 10-27 18:12
www.reddit.com · reddit2026-10-27 18:12
“GhostAction Crosses Paths With PolinRider
submitted by /u/mabote [link] [comments]”