GhostAction Expands GitHub Credential Theft Campaign with New Tactics
In a concerning development for developers utilizing GitHub, attackers associated with GhostAction have intensified their credential theft campaign. The latest stage cleverly camouflages harmful JavaScript code as a font file, specifically targeting developer workstations through tasks within Visual Studio Code. This innovative tactic has raised alarms amongst cybersecurity analysts, underscoring the adaptation of malicious actors in their ongoing operations.
The alarming expansion of this campaign was brought to light by researcher Jenn Gile, who identified a staggering 94 compromised repositories belonging to 66 distinct GitHub users. Notably, the payload confirmed its presence in 79 of the investigated repositories. However, 15 repositories remained inaccessible for analysis, leaving a gap in understanding the full extent of this intrusion.
The investigative efforts by OpenSourceMalware were prompted after Thijs Xhaflaire from Jamf Threat Labs uncovered a cluster linked to the infamous PolinRider infections while searching for related malicious activity. The recent operations represent an extension of an earlier ploy that focused on exploiting GitHub Actions workflows to swipe repository secrets and credentials that had been carelessly exposed in Git history.
How the Attack Operates
The modus operandi of the GhostAction hackers involves placing a launcher command inside the .vscode/tasks.json file, with the payload stored at the path public/fonts/fa-solid-400.woff2. At first glance, this file appears to be a legitimate Font Awesome resource, yet it conceals 38 lines of unobfuscated Node.js code designed to execute malicious functions. A task labeled eslint-check is the key trigger, prompting the execution of Node.js against the disguised script, placing developers’ workstations at significant risk of compromise.
This task utilizes the parameter runOn: folderOpen, which ensures execution whenever developers open the relevant project. To further obfuscate this malicious activity, presentation settings suppress the visibility of terminal processes. It is important to note that actual execution of the malware requires the workspace to be trusted and appropriate permissions for executing automatic tasks. Merely cloning or opening a repository infected by this malware does not guarantee the activation of the malicious script.
When activated, the malware stealthily gathers sensitive information including usernames, hostnames, and various environment variables. It specifically targets credential files associated with numerous platforms such as AWS, npm, PyPI, Git, and more. The malicious script reads RSA and Ed25519 SSH private keys in full, while it restricts access to eight additional credential files to their initial 3,000 characters, making it a highly concerning threat to security.
A methodical recursive search is employed to comb through the home directory for common credential patterns, looking for tokens associated with AWS, GitHub, npm, PyPI, and Anthropic. The gathered data is then transmitted back to the attacker’s server via HTTP POST requests on port 8080. Jenn Gile traced this malicious infrastructure to a specific IP address, identified as 193[.]32[.]204[.]199.
In systems that support cron jobs, the payload installs a scheduled command, set to execute every five minutes. This command retrieves an additional script from a hostname-specific server path, subsequently piping the response into Bash to facilitate the execution of tailored follow-on commands. The entry for this command bears the marker #ghc2, and once installed, it promptly removes any existing entries that match, thereby securing a persistent foothold within the affected systems.
Despite the extensive findings, Gile has reported that the details surrounding the subsequent payload delivered through the server remain elusive, leaving cybersecurity teams in the dark regarding its capabilities and intentions. Additionally, it is noted that Windows systems do not employ the targeted crontab mechanism, although the potential for credential collection execution still looms.
The cybersecurity landscape became even bleaker as most of the second-stage attacks materialized around October 15. Notably, two repository owners who had successfully eliminated prior malicious workflows were found to have re-activated infections, illustrating that simple file deletions were insufficient to rid their systems of the attackers’ long-standing access.
While there are superficial similarities between the GhostAction tactics and the fake-font launchers associated with PolinRider, Gile’s investigation has not established any concrete indicators linking the two operations. Cybersecurity responders are urged to take immediate action: revoking access to compromised GitHub accounts is imperative before beginning cleanup efforts. It is essential to conduct comprehensive inspections of every writable repository, meticulously removing any malicious tasks or workflows, and analyzing endpoint persistence.
Furthermore, credentials that may have been exposed via files, environment variables, or Git history demand immediate rotation from a clean, secure device after comprehensive threat containment measures are enacted.
Indicators of Compromise (IOCs)
In light of the unfolding situation, several key indicators of compromise have been documented to aid in identifying and mitigating this threat. These include several malicious files and network activity linked to the ongoing GhostAction operations. The cybersecurity community is urged to stay vigilant and implement rigorous security measures to safeguard against these evolving threats.
As the cybersecurity landscape continues to evolve, staying informed and diligent becomes paramount for developers and organizations alike, emphasizing the need for ongoing vigilance against such sophisticated hacking campaigns.