GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
GhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.
More info