Oct 192026 GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories GhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.
