GhostAction GitHub attack hit nearly 23,000 repos, GitGuardian says, and now steals keys via a VS Code task

TL;DR: The GhostAction campaign, which pushes malicious code to public GitHub repositories using stolen account tokens, has grown and changed targets. Secrets-scanning firm GitGuardian counted 72,026 commits to 22,964 repositories from October 13 to 21, 2026. One new payload doesn’t need GitHub Actions at all: a hidden VS Code task runs a fake font file that steals cloud, npm, SSH and AI-tool keys from the developer’s own computer when they open the repository. If you or your developers contribute to public repos, check for the planted files and rotate keys.

What happened

GitGuardian published its latest GhostAction report on October 27 (US time; 1:27 a.m. October 28, Manila) and updated it on October 28. It says the operator pushed 72,026 commits to 22,964 repositories belonging to 2,875 owners from October 13 to 21, using 1,792 GitHub accounts. Of those accounts, 1,382 had already pushed the campaign’s October 8 payload, which GitGuardian says shows “the same stolen tokens keep working.” The last GhostAction commit it saw was on October 21 at 04:37 UTC (12:37 p.m. Manila).

The campaign now ships five payload families, according to GitGuardian:

• Planted GitHub Actions workflows that search the code, its history and the wiki for credentials, now with four more AI-provider key patterns.
• Self-hosted runner workflows that read the cloud role credentials and stored keys on the runner machine. 172 repositories received these.
• An updated OIDC payload that tries to sign in to every AWS role named in a workflow’s environment.
• A fake font file and a hidden VS Code task. The file public/fonts/fa-solid-400.woff2 is really a Node.js script, and .vscode/tasks.json runs it when a developer opens the folder in VS Code and trusts the workspace. It reads files including ~/.aws/credentials, .npmrc, .pypirc, .git-credentials, ~/.claude/.credentials.json, ~/.gemini/oauth_creds.json and .kube/config, plus SSH keys and environment variables. GitGuardian found this pair of files in 17,667 repositories.
• A cron job that asks the attacker’s server for a new script every five minutes. Three payloads install it, so cleaning the repository doesn’t remove it.

GitGuardian says GitHub’s hold on malicious workflows stopped every GhostAction workflow it checked from running. The VS Code task isn’t a workflow, so that hold doesn’t apply. GitGuardian also found 188 GhostAction commits that had been rewritten to add loaders from PolinRider, a separate campaign that steals browser logins, password vaults and crypto wallets; it says there are no clear signs the two operators are linked.

Why it matters

The new payload goes after the developer’s laptop, not just the CI pipeline, and it’s after the keys that matter most to a small team: cloud accounts, package registries and AI tools that bill by usage. Opening a repository you cloned to review a pull request or try a project is enough, if you trust the workspace. And because the operator reuses old tokens, an account that was hit in October and only cleaned, not revoked, can be hit again.

What to do now

1. Search your repos. Look on every branch for .vscode/tasks.json files with a “folderOpen” task and for “font” files that are plain text. Delete them; GitGuardian warns that reverting the campaign’s “Update” commits brings back the earlier malicious version.
2. Revoke, then rotate. Revoke the affected account’s tokens, OAuth apps and SSH keys, then rotate every secret in the repository’s history, its Actions secrets and its wiki.
3. Check the machines. On any computer that opened an affected repository in VS Code, and on self-hosted runners, look in the crontab for a line ending in #ghc2, remove it and rotate local keys, including AI tools such as Claude and Gemini.
4. Check for leaks. Look for private gists named “build cache” with a c.dat file. If you use AWS roles with GitHub’s OIDC sign-in, search CloudTrail for AssumeRoleWithWebIdentity calls from repositories or branches you don’t expect, and limit role trust to specific repositories and branches.
5. Lock down VS Code. Our advice: leave the task.allowAutomaticTasks setting at “off”, choose Disallow when a repository you didn’t write asks to run automatic tasks, and don’t trust the workspace for code you haven’t checked; Microsoft says automatic tasks never run in an untrusted workspace.

Stolen developer credentials were also the problem in this month’s LiteLLM package compromise. Our Security hub tracks the rest.

Updates

• Oct 28, 2026, 11:35 p.m. Manila: First published.

Sources & method

Sources

• GhostAction Crosses Paths With PolinRider: Inside the October Escalation (GitGuardian, October 27, 2026, US time; updated October 28)
• GhostAction Returns: 772 Repos Hit, 30k More in Oct (GitGuardian, October 7, 2026)
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File (OpenSourceMalware, October 16, 2026)
• Tasks in Visual Studio Code: control automatic task execution (Microsoft, VS Code documentation)

Method. Checked October 28, 2026, at 10:07 p.m. Manila time (14:07 UTC). The counts, dates, file names, payload behavior and clean-up steps come from GitGuardian’s October 27 report; counts are GitGuardian’s lower bounds from its own feed. We read OpenSourceMalware’s earlier analysis of the fake-font technique, which GitGuardian cites, and took the VS Code setting from Microsoft’s documentation. We found no GhostAction post on GitHub’s blog. Steps labelled “our advice” are our own judgment, not GitGuardian’s or Microsoft’s. The thumbnail is GitGuardian’s header image for its report. No affiliate links on this page. How we work.