GCVE-110-OSM-2026-13807

GhostAction campaign infects a victim either using VS Code tasks.json which executes a malicious fake .woff2 payload through a runOn: folderOpen task, or through a Github Action (workflow file). These repositories have been potentially infected by GhostAction. The vscode/tasks.json file is executed when the victim opens up this repository with Microsoft VS Code. The tasks.json file runs "node ./public/fonts/fa-solid-400.woff2" which is a fake font file that is really a malicious JavaScript file. the fake font file steals system information as well as these credentials: ".aws/credentials", ".pypirc", ".npmrc", ".git-credentials", ".netrc", ".claude/.credentials.json", ".gemini/oauth_creds.json", ".kube/config" it then puts it all in a json blog and exfils it to an IP address controlled by the attacker.