tag: Github-Actions · 10 items
- Engineer — Act: Active campaign directly targeting CI/CD pipelines: stolen tokens plant workflows that echo secrets to Actions logs, then delete the runs. Immediately audit GitHub Actions logs for unexpected workflow runs, rotate all repository and org-level secrets, and tighten token scopes to least privilege.
- SOC/IR — Act: The delete-run-after-exfiltration pattern is a concrete hunt target in GitHub audit logs. Search for workflow run creation followed by rapid deletion, and sweep for tokens with unusual write-workflow permissions used outside normal pipelines since the campaign began.
- Leader — Plan: Active exfiltration campaign targeting private GitHub and GitHub Enterprise repos is worth a this-week check-in: confirm with engineering that no unauthorized workflow runs exist in your org and that secret rotation is scheduled if any anomalies are found.
- Engineer — Plan: Active supply chain campaign targeting GitHub repos via malicious Actions workflows and now fake font files; audit your GitHub Actions workflow dependencies for unexpected changes and scan repos you consume for suspicious binary assets in font or asset directories.
- SOC/IR — Plan: GhostAction is actively evolving TTPs—credential stealer delivery disguised as font files through CI/CD pipelines; build or tune detections for credential-theft behaviors originating from build runners and unusual outbound connections from CI environments, even before specific IOCs are published.
- Leader — Learn: GhostAction illustrates how supply chain attacks via open-source platforms are growing in sophistication; useful framing for board discussions on OSS risk posture, but no specific widely-used vendor breach or near-term regulatory deadline requires immediate leadership action.
- Engineer — Act: Active supply-chain campaign injecting credential-stealing workflows into popular open-source repos you may depend on; audit all GitHub Actions workflow files in your dependency graph for unexpected changes and scan recent CI/CD build logs for credential exfiltration activity.
- SOC/IR — Act: Ongoing campaign with named compromised accounts (e.g., pyxel maintainer) and a known campaign start timestamp; hunt for anomalous outbound connections or secret access events from CI runners since mid-October and check for workflow file changes in repos your build pipelines consume.
- Leader — Plan: A large-scale supply-chain attack targeting CI/CD secrets across 340+ repositories warrants a this-quarter review; direct engineering to inventory critical OSS dependencies and assess whether any build pipelines may have been exposed to the malicious workflows.
- Engineer — Plan: This tool addresses a real supply-chain vector where committed dist/ in a pinned Action can diverge from source — a technique used in past compromises like tj-actions. Evaluate and integrate into your repo audit process this quarter to verify Actions you pin haven’t had tampered dist artifacts.
- SOC/IR — Learn: Provides useful framing for the dist-vs-source discrepancy attack surface in GitHub Actions supply-chain attacks, but no IOCs, active campaigns, or detection rules are surfaced by this tool release itself.
- Leader — Skip
- Engineer — Plan: Supply-chain tampering via committed dist files in GitHub Actions is a real attack vector; evaluate and integrate action-dist-verify into your CI pipeline to catch dist/source divergence in pinned Actions this quarter.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: This tool rebuilds pinned JavaScript Actions from source and diffs the committed dist, addressing the tampered-dist supply-chain vector seen in real incidents. Worth evaluating for inclusion in CI pipelines that pin third-party Actions.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Any pipeline that used actions-cool/issues-helper or actions-cool/maintain-one-comment during the recent reactivation window may have executed malware; audit CI/CD build logs for those action references and treat affected workflow runs as potentially compromised.
- SOC/IR — Act: Hunt across pipeline/SIEM logs for workflow runs invoking actions-cool/issues-helper or actions-cool/maintain-one-comment since last week’s reactivation; flag any execution and initiate IR review of affected build environments.
- Leader — Plan: This recurrence of the Mini Shai-Hulud campaign illustrates the risk of unpinned third-party Actions; use it to drive a policy requiring SHA-pinning and inventory approval for all third-party GitHub Actions across engineering teams this quarter.
- Engineer — Act: Active supply-chain compromise in CI/CD is a direct Act trigger — audit every pipeline that references these affected Actions, check recent build logs for signs of malicious payload execution, and rotate any secrets or tokens exposed to those workflow runs.
- SOC/IR — Plan: No IOCs are published in this item, but the Mini Shai-Hulud campaign name suggests threat-intel feeds may carry indicators — check those feeds and build a detection for anomalous GitHub Actions workflow executions or unexpected secret-access events in your CI/CD telemetry.
- Leader — Plan: A named supply-chain campaign actively re-compromising CI/CD Actions warrants asking your engineering team this quarter to confirm pipeline dependency exposure and report back on whether any credential material was at risk.
- Engineer — Plan: Covers actively exploited vectors — OIDC token extraction, GitHub Actions cache poisoning, and mutable action tag hijacking — directly relevant to any team running modern pipelines; this quarter, pin all Action references to full commit SHAs, scope OIDC tokens to minimum claims per job, and audit build cache configurations for injection risk.
- SOC/IR — Plan: The TTPs described (pipeline cache poisoning, OIDC token exfiltration, compromised scan tools executing in CI) map to credential-access and supply-chain-compromise ATT&CK techniques with a growing log surface; prioritize collecting GitHub Actions audit logs into SIEM and build detections for anomalous OIDC token issuance or unexpected cache write events.
- Leader — Learn: Establishes that sophisticated actors are systematically targeting engineering toolchains — useful context for supply chain risk conversations with auditors or customers, but no specific vendor breach or regulatory deadline requiring immediate leadership action.
- Engineer — Plan: This is a textbook workflow injection pattern — untrusted input from issue metadata flowing into shell steps. Audit your own repos under .github/workflows/ for any workflow triggered by issue/PR events that interpolates github.event.issue.title or body into run: commands, and replace with intermediate env vars or safe contexts.
- SOC/IR — Learn: No IOCs or active exploitation are reported, so there is nothing to hunt or detect today; however, understanding that crafted GitHub issues can trigger arbitrary commands in CI pipelines is useful context for evaluating future CI/CD-targeted campaigns.
- Leader — Skip