(opensourcemalware.com) GhostAction Campaign Evolves with PolinRider-Inspired Infostealer Hidden in Fake Font Files In brief - This article describes an evolution of the GhostAction campaign, which now employs a second-stage attack that uses fake font files and VS Code tasks to steal developer credentials and establish persistent remote access. Technically - This article details a multi-stage attack where Stage 1 uses malicious GitHub Actions workflows to exfiltrate repository secrets. Stage 2 leverages a .vscode/tasks.json file with a 'runOn: folderOpen' trigger to execute a malicious Node.js payload disguised as a .woff2 font file. This payload targets sensitive files (AWS, SSH, kubeconfig, and AI tool tokens) and environment variables, exfiltrating them via HTTP POST to a hardcoded IP (193[.]32[.]204[.]199) on port 8080. Additionally, the malware installs a cron job that polls the attacker's C2 server every five minutes to execute arbitrary bash scripts, providing the threat actor with persistent remote command execution (RCE) on the developer's machine. Source: https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file #Cybersecurity