GhostAction Crosses Paths With PolinRider: Inside the October Escalation

Between October 13 and 21, 2026, the GhostAction campaign reportedly used previously stolen GitHub tokens to push more than 72,000 malicious commits across nearly 23,000 public repositories, including roughly 8,000 newly affected repositories. The operation deployed five payload families targeting GitHub-hosted workflows, self-hosted runners, developer machines, and AWS roles accessible through GitHub OpenID Connect, with goals including harvesting cloud, registry, AI-tool, SSH, and other credentials. Although GitHub reportedly blocked execution of the malicious workflow files, a Node.js credential stealer disguised as a font file could run when a trusted repository folder was opened in VS Code, and several payloads attempted to establish persistence through a cron job that fetched commands from a command-and-control server every five minutes. Researchers also observed that some GhostAction commits were later force-pushed with PolinRider loaders, a separate multi-stage malware chain focused on browser sessions, password managers, and cryptocurrency wallets, though the relationship between the operators remains uncertain. Recommended response measures include removing malicious files from all branches, revoking compromised tokens, rotating repository and local credentials, inspecting developer devices and self-hosted runners for persistence, reviewing private gists and AWS OIDC activity, and checking VS Code task configurations and text-based files posing as fonts.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.