GhostAction compromised 94 GitHub repositories with a hidden VS Code task that executed a credential stealer disguised as a Font Awesome file and installed a five-minute cron command channel. The launcher closely copied a technique pioneered by North Korea’s PolinRider campaign, and one repository separately contained a blockchain-backed PolinRider loader. The researchers found no shared infrastructure or indicators between the operations and assess GhostAction as a copycat rather than a DPRK campaign extension. The payload targeted SSH keys, cloud and package-registry credentials, Kubernetes configuration, GitHub tokens, and AI-service logins.