GCVE-110-OSM-2026-14218

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a workflow that searches the repository and its git history for credentials and sends them to the attacker's server (added August 31, 2026) and a credential stealer disguised as a font file and a hidden VS Code task that runs it when the folder is opened (added October 15, 2026). Anyone who opened the project in VS Code with automatic tasks allowed after October 15, 2026 should treat that machine's credentials as compromised, because the stealer also installs a scheduled job that runs commands from the attacker's server every five minutes. An earlier GhostAction workflow, first pushed September 1, 2025, is also in its history, so the account was compromised before the October 2026 wave. ## Payload 1: workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/security-audit.yml` First pushed October 8, 2026. Updated 1 time afterwards. A GitHub Actions workflow named like a security check. It runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns (AWS, Anthropic, OpenAI, GitHub, Google, Slack and similar), and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag in the query string. It installs nothing. ## Payload 2: shortened workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/ci-check.yml` First pushed October 16, 2026. A GitHub Actions workflow that runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns, and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. It is a trimmed copy of the second-stage workflow, without the wiki search or the gist fallback. It installs nothing. ## Payload 3: second workflow that searches the repository, its history and its wiki Malicious payload found in: `.github/workflows/code-review.yml`, `.github/workflows/lint.yml` First pushed October 15, 2026. Updated 1 time afterwards. A GitHub Actions workflow that runs on every push and on manual dispatch. It checks out the full git history, searches the working tree, every commit (`git log -p --all`) and the repository's wiki (cloned with the job's `GITHUB_TOKEN`) for credential patterns, and sends the result with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. If that request fails it creates a private gist containing the same data through the GitHub API using `GITHUB_TOKEN`. Many versions also add named repository secrets (`${{ secrets.NAME }}`) to the upload. The attacker used a different file name and display name in different repositories. It installs nothing. ## Payload 4: workflow that sends named repository secrets Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed August 31, 2026. Updated 1 time afterwards. A small GitHub Actions workflow (job `send-secrets`, step `Prepare Cache Busting`, the same names as the 2025 GhostAction workflow) that runs on every push and on manual dispatch and sends a list of named repository secrets (`NAME=${{ secrets.NAME }}`) with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag on later versions. The secret names differ from repository to repository. It does not search the repository or its history and installs nothing. ## Payload 5: workflow that tries to turn a CI token into AWS credentials Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed October 21, 2026. A GitHub Actions workflow that runs on every push and on manual dispatch. It requests a GitHub Actions OIDC token for the audience `sts.amazonaws.com` from GitHub's own token service, then looks through the environment for variables whose values look like AWS IAM role ARNs (up to ten) and calls `aws sts assume-role-with-web-identity` with the token for each. The responses, which contain temporary AWS credentials, are sent with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with the batch tag `oidc_og2`, and named repository secrets are sent with the tag `og2`. The file defines no role ARN itself, so whether the exchange succeeds depends on variables set elsewhere. It installs nothing. ## Payload 6: September 2025 style workflow that sends named secrets Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed September 1, 2025. Updated 2 times afterwards. A small GitHub Actions workflow (job `send-secrets`, step `Prepare Cache Busting`) in the style of the first GhostAction wave. It runs on pushes and sends a list of named repository secrets (`NAME=${{ secrets.NAME }}`) with `curl` to an attacker-controlled host. In the copies found in this repository the destination is one of the 2025 exfiltration hosts (`bold-dhawan[.]45-139-104-115[.]plesk[.]page`, `carte-avantage[.]com` or `170[.]39[.]218[.]2`), not the server used in October 2026. ## Payload 7: credential stealer disguised as a font file Malicious payload found in: `public/fonts/fa-solid-400.woff2` First pushed October 15, 2026. Despite the `.woff2` extension this is a short, unobfuscated Node.js script. When run it reads the first 3,000 bytes of `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials`, `~/.netrc`, `~/.claude/.credentials.json`, `~/.gemini/oauth_creds.json` and `~/.kube/config`, and the SSH private keys `id_rsa` and `id_ed25519` in full. It runs a recursive `grep` of the home directory for AWS, Anthropic, GitHub, npm and PyPI token patterns and collects environment variables whose names begin with `AWS_`, `ANTHROPIC`, `OPENAI`, `HF_TOKEN`, `GITHUB_TOKEN`, `_API_KEY` or `_TOKEN`. Everything is sent with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080, with a batch tag in the query string. It then installs a crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server at a path keyed by the machine's hostname and pipes it to `bash`, which gives the operator remote command execution. The file does nothing on its own: it runs when the VS Code task below, or `node`, executes it. ## Payload 8: VS Code launcher Malicious payload found in: `.vscode/tasks.json` First pushed October 15, 2026. Defines a hidden shell task labelled `eslint-check` that runs `node ./public/fonts/fa-solid-400.woff2` with its output suppressed. It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code. The task sends nothing and installs nothing itself.