--- title: GhostAction Crosses Paths With PolinRider: Inside the... description: GhostAction pushed 72,026 commits to 22,964 public repositories between Oct. 13 and Oct. 21, with 7,989 new victims among them. Of 1,792 pushing accounts,... canonical: https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostAction Crosses Paths With PolinRider: Inside the October Escalation | daily.dev og:description: GhostAction pushed 72,026 commits to 22,964 public repositories between Oct. 13 and Oct. 21, with 7,989 new victims among them. Of 1,792 pushing accounts,... og:url: https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma og:image: https://api.daily.dev/og/posts/O1UexrBma.png og:image:alt: GhostAction Crosses Paths With PolinRider: Inside the October Escalation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostAction Crosses Paths With PolinRider: Inside the October Escalation **[GitGuardian](https://daily.dev/sources/gitguardian)** · 11 min read · 0 upvotes · 0 comments ## Summary GhostAction pushed 72,026 commits to 22,964 public repositories between Oct. 13 and Oct. 21, with 7,989 new victims among them. Of 1,792 pushing accounts, 1,382 had already pushed the Oct. 8 payload, so the same stolen tokens keep working. The campaign now spreads five payload families, including one that disguises a Node.js stealer as a font file launched automatically when a developer opens the repo in VS Code. That launcher appears copied from PolinRider, a separate campaign once attributed to DPRK, and 188 GhostAction commits were rewritten to include PolinRider loaders. Three payload families also install a cron job that re-fetches C2 scripts every five minutes, and cleaning the repository does not remove it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many commits and repositories did the GhostAction supply chain attack hit in its October wave? The GhostAction operator pushed 72,026 commits across 22,964 repositories, 2,875 owners, and 1,792 pushing accounts between October 13 and 21. Of those repositories, 14,906 were already compromised in the earlier October 8 wave, while 7,989 were new victims. The peak day was October 15, with 32,099 commits. _Teams auditing CI pipelines for compromise can follow incident writeups like this on daily.dev._ ### How does the GhostAction font-stealer malware get executed on a developer's machine? It plants two files in separate commits: a Node.js script disguised as public/fonts/fa-solid-400.woff2, and a .vscode/tasks.json defining a hidden task. When a developer opens the folder in VS Code and trusts the workspace, the task auto-runs the fake font file, which steals credentials from files like ~/.aws/credentials, .npmrc, and ~/.claude/.credentials.json and posts them to a C2 server. _Developers vetting unfamiliar repos before opening them in VS Code can track these techniques on daily.dev._ ### What is the difference between the GhostAction and PolinRider malware campaigns found in the same repositories? GhostAction's font stealer is about 40 readable lines of code that posts stolen cloud, registry, and AI tool credentials to an IP address on port 8080. PolinRider's payload is a multi-stage, obfuscated loader chain using an Ethereum transaction address for command-and-control, ultimately targeting browser logins, cookies, and crypto wallet extensions rather than developer credentials. _Security teams tracking overlapping malware campaigns can follow breakdowns like this one on daily.dev._ ## Similar posts on daily.dev - [PolinRider: North Korea-Linked Supply Chain Campaign Expands...](https://daily.dev/posts/polinrider-north-korea-linked-supply-chain-campaign-expands--xkzgy7ucd) · Socket · 0 upvotes · 0 comments - [GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) · StepSecurity · 0 upvotes · 0 comments - [Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks](https://daily.dev/posts/four-credential-harvesting-campaigns-hit-open-source-ecosystems-in-two-weeks-gtsbqgosw) · GitGuardian · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#vscode](https://daily.dev/tags/vscode), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GhostAction Crosses Paths With PolinRider: Inside the October Escalation","url":"https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma"},"datePublished":"2026-10-27T17:32:27.597Z","dateModified":"2026-10-28T22:25:21.788Z","description":"GhostAction pushed 72,026 commits to 22,964 public repositories between Oct. 13 and Oct. 21, with 7,989 new victims among them. Of 1,792 pushing accounts,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81eea137f74feea38b5fc0442635b498?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81eea137f74feea38b5fc0442635b498?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitGuardian","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitGuardian","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/406f3b707b1741f7b988cf561463a54d","url":"https://daily.dev/sources/gitguardian"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,vscode,github-actions","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitGuardian","item":"https://daily.dev/sources/gitguardian"},{"@type":"ListItem","position":3,"name":"GhostAction Crosses Paths With PolinRider: Inside the October Escalation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostaction-crosses-paths-with-polinrider-inside-the-october-escalation-o1uexrbma#faq","mainEntity":[{"@type":"Question","name":"How many commits and repositories did the GhostAction supply chain attack hit in its October wave?","acceptedAnswer":{"@type":"Answer","text":"The GhostAction operator pushed 72,026 commits across 22,964 repositories, 2,875 owners, and 1,792 pushing accounts between October 13 and 21. Of those repositories, 14,906 were already compromised in the earlier October 8 wave, while 7,989 were new victims. The peak day was October 15, with 32,099 commits. Teams auditing CI pipelines for compromise can follow incident writeups like this on daily.dev."}},{"@type":"Question","name":"How does the GhostAction font-stealer malware get executed on a developer's machine?","acceptedAnswer":{"@type":"Answer","text":"It plants two files in separate commits: a Node.js script disguised as public/fonts/fa-solid-400.woff2, and a .vscode/tasks.json defining a hidden task. When a developer opens the folder in VS Code and trusts the workspace, the task auto-runs the fake font file, which steals credentials from files like ~/.aws/credentials, .npmrc, and ~/.claude/.credentials.json and posts them to a C2 server. Developers vetting unfamiliar repos before opening them in VS Code can track these techniques on daily.dev."}},{"@type":"Question","name":"What is the difference between the GhostAction and PolinRider malware campaigns found in the same repositories?","acceptedAnswer":{"@type":"Answer","text":"GhostAction's font stealer is about 40 readable lines of code that posts stolen cloud, registry, and AI tool credentials to an IP address on port 8080. PolinRider's payload is a multi-stage, obfuscated loader chain using an Ethereum transaction address for command-and-control, ultimately targeting browser logins, cookies, and crypto wallet extensions rather than developer credentials. Security teams tracking overlapping malware campaigns can follow breakdowns like this one on daily.dev."}}]} ```