GhostAction Campaign Evolves, Shifting Focus to Developer Endpoints After Initial Wave Fizzles
The GhostAction supply chain attack campaign, which previously targeted GitHub repositories, has adapted its tactics to focus on compromising developer endpoints and cloud access, though its latest wave of attacks has shown limited success.
The ongoing GhostAction campaign, known for its strategy of compromising developer accounts to inject malicious GitHub Actions workflow files into repositories, has recently demonstrated an evolution in its attack vectors. While the initial wave of attacks targeting GitHub repositories in early October saw attackers push the security-audit.yml workflow into approximately 30,000 repositories, a subsequent escalation between October 13th and 21st involved 72,000 commits to 23,000 public repositories, with 8,000 of these being new targets. However, research published on October 27th indicates that this latest surge of activity has largely failed to achieve its objectives.
This evolving campaign's strategy now appears to be shifting from solely compromising code repositories to targeting developer endpoints and cloud access. This pivot is significant as it highlights the increasing threat to the broader developer infrastructure and cloud environments, which are often considered high-value targets due to the sensitive credentials and access they contain. The attackers are leveraging GitHub's inherent trust in workflow files to seize repository secrets, package publishing tokens, GitHub personal access tokens, and credentials embedded within source code.
During the most recent phase of the campaign, researchers observed that the operator deployed various payloads depending on the type of runner executing the GitHub Actions workflows. These included payloads designed to search for credentials within GitHub runner repositories and wikis, specifically targeting AI-provider API keys. Another payload, the Security-audit.yml file, continued its function of searching for credentials in source code and Git history. Additionally, payloads were developed to target self-hosted runners and to request GitHub OIDC tokens for AWS role assumption, aiming for cloud account access.
A particularly notable payload observed is the "font stealer," which installs a Node.js credential stealer on local developer machines, disguised as a VS Code task. This technique appears to be a direct copy from the PolinRider campaign, which has been associated with North Korea and hides obfuscated loaders in developer repositories to steal credentials. The GhostAction operator also added PolinRider loaders to repositories already impacted by the campaign.
Despite the sophistication of these evolving tactics, GitHub has actively identified and prevented the execution of these malicious workflows. Furthermore, GitGuardian, the research firm that detailed these findings, has indicated that there is no evidence that the local stealer payload actually ran. However, the campaign's persistence is underscored by the fact that attackers maintained access to nearly 1,800 compromised accounts, many of which had been compromised in earlier GhostAction activity, suggesting that stolen tokens remain effective.
While the current wave of GhostAction attacks may have been largely ineffective in execution, the campaign's adaptation and the nature of its payloads, particularly those aimed at cloud access, signal a potential future strategy. The attackers' "fail early and adapt fast" approach, combined with the observed imitation of techniques from other campaigns like PolinRider, suggests a persistent and evolving threat actor. The campaign's operator may be leveraging AI tools to test and iterate on different payload variants more rapidly.
Organizations targeted by GhostAction are advised to actively search for and remove the malicious workflow files from all branches of their repositories. If signs of compromise are detected, it is crucial to revoke the compromised account's tokens, rotate all credentials within the affected repository and its history, and secure all GitHub Actions secrets and wiki credentials. The continued presence of compromised accounts highlights the need for vigilant monitoring and prompt remediation to mitigate the risks posed by this evolving supply chain threat.