supply-chain
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
Medium
Summary
The GhostAction supply chain attacker has evolved their tactics, now leveraging a fake login page hosted on a new domain, 'my-github[.]com,' to steal GitHub access tokens and two-factor authentication codes. The campaign has impacted 94 repositories, with many now abandoned and a significant number of repositories untouched for over a year.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data