GHOSTACTION PHISHING CAMPAIGN

Summary from the TLDR InfoSec newsletter

GhostAction operators used a GitHub reverse-proxy kit on my-github[.]com to relay maintainers' passwords and TOTP codes, while injected JavaScript silently approved an OAuth device flow with repo, workflow, and read:org scopes. The domain shared 193.32.204[.]199 with GhostAction's workflow exfiltration server, though a single lure does not prove phishing caused the earlier maintainer compromises. Defenders should revoke grants tied to OAuth client ID Ov23ctrqCqZ79UaYKwyq, rotate CI/CD and registry secrets, and audit .github/workflows/ for injected files.