GhostAction Supply Chain Attack: Credential Stealer Disguised as a Font File in 94 GitHub Repos — Detection and Response Guide

---
title: Execution of File Masquerading as Font
description: Detects execution of a file whose name carries a font extension (.ttf, .otf, .woff, .woff2, .fnt). Fonts are data files rendered by system libraries; they should never appear as an executed image. Consistent with GhostAction's stealer delivery disguised as a fake font file.
references:
  - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
id: 3f7a2c41-9b5e-4d18-a6c2-7e1f0d8b4a93
status: experimental
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '.ttf'
      - '.otf'
      - '.woff'
      - '.woff2'
      - '.fnt'
  condition: selection
falsepositives:
  - Extremely rare; corrupted telemetry or misnamed internal tooling
level: high
tags:
  - attack.defense_evasion
  - attack.t1036
---
title: Non-Browser Process Accessing Browser Credential Stores
description: Detects a non-browser process referencing browser credential artifacts (Login Data, Local State, Cookies, Web Data) on the command line. Stealers, including those distributed in the GhostAction campaign, routinely copy these locked files before parsing credentials and session tokens offline.
references:
  - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
id: 8c1d4e62-2a7f-4b39-9d05-5c6e3a1f7b28
status: experimental
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    CommandLine|contains:
      - '\Login Data'
      - '\Local State'
      - '\Network\Cookies'
      - '\Web Data'
      - 'logins.json'
      - 'key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\opera.exe'
  filter_browsers_child:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_paths and not 1 of filter_*
falsepositives:
  - Enterprise password managers or EDR forensics tooling legitimately inspecting browser stores; allowlist by signer and hash
level: high
tags:
  - attack.credential_access
  - attack.t1555.003
---
title: GitHub Actions Runner Secret Harvesting Behavior
description: Detects secret-dumping behavior from a GitHub Actions runner process, consistent with malicious workflows injected by the GhostAction actor. Includes environment enumeration (printenv, /proc/self/environ) and base64-encoded piping to curl/wget, which legitimate workflows almost never perform.
references:
  - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
id: 5b9e7a30-1c4d-48f6-b2a1-9d3c6f0e5a74
status: experimental
date: 2026/10/15
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Runner.Worker'
      - '/Runner.Listener'
  selection_envdump:
    CommandLine|contains:
      - 'printenv'
      - '/proc/self/environ'
      - '/proc/1/environ'
      - 'env |'
  selection_b64_exfil:
    CommandLine|contains:
      - 'base64'
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/sh'
      - '/bash'
  condition: selection_parent and 1 of selection_*
falsepositives:
  - Rare; some debugging steps dump environment variables in CI. Review the originating workflow file and commit author before dismissing.
level: high
tags:
  - attack.credential_access
  - attack.t1552
  - attack.exfiltration

// Hunt 1: Font-masquerade execution + non-browser access to credential stores
let lookback = 14d;
let browsers = dynamic(["chrome.exe","msedge.exe","brave.exe","firefox.exe","opera.exe"]);
let FontExec = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (".ttf",".otf",".woff",".woff2",".fnt")
       or ProcessCommandLine has_any (".ttf",".otf",".woff2")
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessAccountName;
let CredStoreAccess = DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where FolderPath has_any ("Login Data","Local State","Network\\Cookies","Web Data","logins.json","key4.db")
    | where InitiatingProcessFileName !in~ (browsers)
    | where ActionType in~ ("FileCreated","FileModified","FileRenamed")
    | project TimeGenerated, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
FontExec
| union CredStoreAccess
| sort by TimeGenerated desc;

// Hunt 2: Secret harvesting on self-hosted GitHub Actions runners (Syslog ingestion)
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName has_any ("curl","wget","bash","sh","env")
   or SyslogMessage has_any ("Runner.Worker","Runner.Listener")
| where SyslogMessage has_any ("printenv","/proc/self/environ","/proc/1/environ","env |","base64")
| where SyslogMessage has "Runner"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

-- GhostAction font-masquerade hunt: font-extension files that are actually executables
SELECT FullPath, Size, Mtime, Magic,
       hash(path=FullPath) AS Hash
FROM (
  SELECT FullPath, Size, Mtime,
         read_file(filename=FullPath, length=4) AS Magic
  FROM glob(globs=[
    'C:\\Users\\*\\Downloads\\**.{ttf,otf,woff,woff2,fnt}',
    'C:\\Users\\*\\Desktop\\**.{ttf,otf,woff,woff2,fnt}',
    'C:\\Users\\*\\AppData\\Local\\Temp\\**.{ttf,otf,woff,woff2,fnt}'
  ])
)
WHERE Magic =~ '^(MZ|\\x7fELF)'

#!/usr/bin/env bash
# GhostAction supply-chain audit — requires: gh CLI (authenticated), git
set -euo pipefail
ORG="${1:?Usage: $0 <github-org>}"
DAYS="${2:-30}"
SINCE=$(date -d "-${DAYS} days" +%Y-%m-%d 2>/dev/null || date -v-"${DAYS}"d +%Y-%m-%d)

echo "[*] Auditing org: ${ORG} | workflow changes since ${SINCE}"

# 1) Flag recently added/modified workflow files across all repos
for repo in $(gh repo list "$ORG" --limit 500 --json nameWithOwner -q '.[].nameWithOwner'); do
  gh api "repos/${repo}/commits?path=.github/workflows&since=${SINCE}T00:00:00Z" \
    --jq '.[] | "\(.sha[0:8]) \(.commit.author.date) \(.commit.author.name) \(.commit.message | split("\n")[0])"' 2>/dev/null \
    | while read -r line; do echo "[WORKFLOW-CHANGE] ${repo}: ${line}"; done
done

# 2) Search workflow contents for secret-harvesting / exfil patterns
echo "[*] Scanning workflow content for suspicious patterns"
gh search code --owner "$ORG" --language yaml \
  'printenv OR "/proc/self/environ" OR "base64 -d" OR "curl -d" path:.github/workflows' \
  --json repository,path -q '.[] | "[SUSPICIOUS-WORKFLOW] \(.repository.nameWithOwner): \(.path)"' 2>/dev/null || true

# 3) Hunt font-extension blobs in repos (potential masqueraded payloads)
echo "[*] Searching for font files committed to repositories"
gh search code --owner "$ORG" --extension ttf --json repository,path \
  -q '.[] | "[FONT-FILE] \(.repository.nameWithOwner): \(.path)"' 2>/dev/null || true
gh search code --owner "$ORG" --extension otf --json repository,path \
  -q '.[] | "[FONT-FILE] \(.repository.nameWithOwner): \(.path)"' 2>/dev/null || true
gh search code --owner "$ORG" --extension woff2 --json repository,path \
  -q '.[] | "[FONT-FILE] \(.repository.nameWithOwner): \(.path)"' 2>/dev/null || true

echo "[*] Done. Manually verify any FONT-FILE hits with: git show <sha>:<path> | xxd | head -1"
echo "    'MZ' or 'ELF' magic in a font file = active compromise. Rotate all repo and maintainer secrets immediately."

# GhostAction font-masquerade endpoint sweep + quarantine
$ScanPaths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:TEMP", "$env:USERPROFILE\AppData\Local\Temp")
$FontExts  = @('.ttf', '.otf', '.woff', '.woff2', '.fnt')
$Quarantine = "C:\IR-Quarantine\GhostAction-$(Get-Date -Format 'yyyyMMdd')"

foreach ($path in $ScanPaths) {
    if (-not (Test-Path $path)) { continue }
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $FontExts -contains $_.Extension.ToLower() } |
        ForEach-Object {
            $fs = [System.IO.File]::OpenRead($_.FullName)
            $buf = New-Object byte[] 4
            [void]$fs.Read($buf, 0, 4); $fs.Close()
            $magic = [System.Text.Encoding]::ASCII.GetString($buf)
            # Legit fonts: 0x00010000, 'OTTO', 'wOFF', 'wOF2'. Anything else is suspicious.
            if ($magic -match '^MZ' -or $buf[0] -eq 0x7F -and $magic -match 'ELF' -or
                ($magic -notmatch 'OTTO|wOFF|wOF2' -and -not ($buf[0] -eq 0x00 -and $buf[1] -eq 0x01))) {
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                Write-Warning "MASQUERADE: $($_.FullName) | SHA256: $hash | Magic: $($buf | ForEach-Object { $_.ToString('X2') })"
                New-Item -ItemType Directory -Path $Quarantine -Force | Out-Null
                Move-Item $_.FullName -Destination $Quarantine -Force
                Write-Host "[+] Quarantined to $Quarantine" -ForegroundColor Yellow
            }
        }
}
Write-Host "[*] Sweep complete. If hits were found: rotate browser-stored credentials, revoke GitHub/cloud CLI tokens on this host, and check for unauthorized workflow commits by this user's account."