As reported by The Hacker News, the GhostAction supply chain campaign has entered a concerning new phase — one that shifts the attack surface from automated workflow abuse to direct social engineering of open-source maintainers. This evolution deserves close attention from every organization that consumes open-source software, which is to say: all of them.

Threat Alert: As reported by The Hacker News, the GhostAction supply chain campaign has entered a concerning new phase — one that shifts the attack surface from automated workflow abuse to direct social engineering of open-source maintainers.

Why This Matters: The OAuth Token Is the New Password

The most technically significant element of this campaign isn't the phishing email or the fake login page — it's the abuse of GitHub's OAuth device flow to silently authorize a malicious application with repo, workflow, and read:org scopes. Once that authorization completes, the attacker holds a long-lived access token that bypasses 2FA entirely. This is device code phishing applied to a developer identity provider, and it's devastatingly effective because the token survives credential rotation.

The attacker doesn't need your password once they have your OAuth token. They can read every repo you can read, modify every workflow you can write, and enumerate every organization you belong to — indefinitely, until the token is revoked.

The reverse-proxy architecture described — where the attacker relays the victim's session through my-github[.]com, extracts the device code, and auto-submits the authorization form — represents a maturation of adversary-in-the-middle (AiTM) phishing that specifically targets the GitHub device flow. This is not script-kiddie territory; it's a deliberate circumvention of GitHub's remediation steps.

Who Is at Risk

Who Is at Risk
Open-source maintainers with write access to popular repositories — a single compromise can infect downstream consumers numbering in the thousands or millions.
GitHub Organization admins whose members have broad OAuth scopes; the read:org scope enables reconnaissance that feeds targeted follow-on attacks.
CI/CD pipelines that trust GitHub Actions workflows — if a workflow file is modified by a token-holding attacker, every subsequent build runs attacker-controlled code.
Enterprises consuming open-source — the blast radius extends to any organization pulling dependencies from affected repositories.

The Broader Pattern: Trust Chokepoint Exploitation

GhostAction illustrates a pattern we've tracked across 2025–2026: attackers increasingly target the identity and publishing infrastructure of code-hosting platforms rather than individual packages. The my-gitlab[.]com domain registered weeks earlier suggests the operator is building a portfolio of lookalike infrastructure across multiple platforms. Whether or not it's the same actor, the playbook is identical: impersonate the platform, intercept credentials and tokens, pivot to supply chain insertion.

The font-file delivery mechanism for the stealer component adds a second layer of defense evasion — font files are rarely inspected by endpoint security tooling, and developers routinely install fonts for documentation and UI work.

Shield53 Recommendations

  • Audit OAuth app authorizations immediately. In GitHub: Settings → Applications → Authorized OAuth Apps. Revoke any application you don't recognize or that has unnecessary workflow scope. Review organization-level app approvals as well.
  • Enforce SSO with SAML + conditional access for GitHub Enterprise organizations. Require device compliance checks and restrict OAuth app installations via org-level policies.
  • Enable GitHub's token expiration policies and rotate any personal access tokens (PATs) older than 90 days. Prefer fine-grained PATs over classic tokens.
  • Block lookalike domains at the DNS layer. Add my-github[.]com, my-gitlab[.]com, and pattern-based blocks for *-github.* / *-gitlab.* lookalikes to your web proxy and email gateway block lists.
  • Implement workflow file change monitoring. Alert on any modification to .github/workflows/*.yml files outside of expected PR review patterns. Use GitHub's workflow_file_change audit log events.
  • Train developers on device code phishing. The tell-tale sign is any prompt asking to enter a code at github.com/login/device that originates from an email link rather than a direct navigation. Establish a policy: never click email links to authentication pages — navigate manually.
  • Scan dependencies for compromise. Use tools like GitHub Dependabot, Socket, or similar supply chain security platforms to detect anomalous changes in transitive dependencies.
  • Network-level detection: Block and alert on outbound connections to 193.32.204.199 on TCP/8443, the known exfiltration endpoint.

The GhostAction campaign is a reminder that supply chain security isn't just about package signatures and SBOMs — it's about protecting the human and identity layer that governs what gets published. Every compromised maintainer token is a potential entry point into thousands of downstream systems. Treat developer identity with the same zero-trust scrutiny you apply to production infrastructure.