Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
GhostAction Phishing Campaign | OpenSourceMalware BLOG GhostAction Phishing Campaign GhostAction operators used a targeted GitHub phishing proxy to steal developer credentials and one-time codes using a sophisticated GitHub phishing kit By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · 2026-10-11T21:49:22.219Z Two days ago, in our last blog post , we warned our readers that the GhostAction threat actor had registered a new domain my-github[.]com and we theorized that they were…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →17 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 3eebe7d8c33c1ffd3876be6a44bedcfbccb09c43ecd3562d7242fe43e244fc51 | Medium | Score 53/100 | First seen |
| URL | http://my-github.com/ | High | Score 58/100 | First seen |
| URL | https://my-github.com/SDRVuhYw | High | Score 63/100 | First seen |
| URL | https://my-github.com/sessions/two-factor/app | High | Score 58/100 | First seen |
| URL | https://my-github.com:8443/t?value= | High | Score 58/100 | First seen |
| URL | https://my-github.com:8443/t | High | Score 58/100 | First seen |
| SHA256 | 2c2066652172b6358a573e993ed413c6137a042268b5188394169650fefb2313 | Medium | Score 53/100 | First seen |
| IP | 193.32.204.199 | High | Score 85/100 | First seen |
| SHA256 | 68c20885a3e234c9eb1e4f87a7013298923646f9c50dfdad97a9e35d989119f8 | Medium | Score 53/100 | First seen |
| URL | http://my-github.com/SDRVuhYw | High | Score 58/100 | First seen |
| SHA256 | 6b159fd26f574345a095aed40e27b73c3a22d35c7de5464436810d9cd89223f2 | Medium | Score 53/100 | First seen |
| IP | 95.214.27.108 | High | Score 58/100 | First seen |
| Domain | my-gitlab.com | High | Score 63/100 | First seen |
| URL | https://my-github.com/login | High | Score 58/100 | First seen |
| SHA256 | 10ef603a50587a8fb6b44829b9eff8c188637d9bc7eeda5c5986b34d43cf7cdb | Medium | Score 53/100 | First seen |
| URL | https://my-github.com/session | High | Score 58/100 | First seen |
| SHA256 | e6bdd7e782ef2fbf42209509993811a63ae19f1580d2453b8324b87db5ad1449 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…