GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The Hacker News published a report dated October 19, 2026, describing a campaign it calls GhostAction, in which attackers planted a credential stealer disguised as a font in 94 GitHub repositories. The headline and URL are the only substantive content in the supplied source text; the remainder is embedded @font-face CSS for the Roboto typeface, listing font weights, unicode ranges, and woff2 file paths. Because of that, the excerpt does not describe how the disguised font was delivered, what credentials the stealer targeted, which repositories or organizations were involved, or whether the malicious files have been removed. The one concrete figure the source supports is the repository count: 94. No indicators of compromise, file names, commit details, or attacker infrastructure are given in the text provided. Readers should treat the headline as the extent of what this excerpt confirms and consult the original article for the technical specifics that the page markup here does not include.
The report indicates a credential stealer was hidden as a font file in 94 GitHub repositories, a reminder that repository contents can carry disguised malicious files.