Threat researchTracked by EncryptLayer intelligence
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
- Published by
- opensourcemalware.com
- Published
- 16 Oct 2026
- Indicators
- none submitted
The report
A cluster of 1200+ compromised repos have a second stage that autoruns a credential stealer and installs a cron job.
Read the full analysis: GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File (opensourcemalware.com).
Indicators
The report is tracked for context; no indicator from it met the bar for blocking (for example, it only names shared hosting).
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#22). This page is generated from that record and the report’s own title and summary; nothing is rewritten.