Security News GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories TheHackerNews Daniel Bender 19 Oct 2026 Share GhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.
