Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
Malware Families
Excerpt
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File | OpenSourceMalware BLOG GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File A cluster of 94 compromised repos have a second stage that autoruns a credential stealer and installs a cron job By cb482791-4ef1-4762-96ad-b0ca4bdd538e · 2026-10-16T05:15:00.000Z We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db | Medium | Score 53/100 | First seen |
| SHA256 | cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60 | Medium | Score 53/100 | First seen |
| SHA256 | d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f | Medium | Score 53/100 | First seen |
| SHA256 | 6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19 | Medium | Score 53/100 | First seen |
| URL | http://193.32.204.199:8080/?c=security | High | Score 58/100 | First seen |
| URL | http://193.32.204.199:8080/c2/ | High | Score 58/100 | First seen |
| SHA256 | 61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6 | Medium | Score 53/100 | First seen |
| URL | http://193.32.204.199/?c=new | High | Score 58/100 | First seen |
| SHA256 | 40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c | Medium | Score 53/100 | First seen |
| SHA256 | a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb | Medium | Score 53/100 | First seen |
| URL | http://193.32.204.199:8080/?c=reinject | High | Score 58/100 | First seen |
| URL | http://193.32.204.199:8080/?c=auto_20261013 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…