CI/CD Pipeline Hijack: GitHub Actions Compromise

You have been paged on a suspected CI/CD compromise affecting the GitHub Actions environment. Early in the shift, an automated alert flags an unusual execution pattern on a build runner. Before reconstructing what happened, establish whose identity was driving the automated activity on the runner around that alert, so later steps can separate legitimate automation from abuse.

Having tied the runner activity to the automation account, turn to how the malicious code entered the pipeline. CloudTrail telemetry for the GitHub API proxy shows a third-party GitHub Action having its version tag rewritten in the days before the incident. Identify which GitHub Action dependency was tampered with to become the foothold in this supply-chain compromise.

With the tampered action identified, examine how the runner environment was staged when the poisoned workflow executed. The telemetry around the unusual connection from the Linux runner shows a third-party setup utility being pulled in during the environment-initialization phase of the job. Identify that setup action file referenced in the runner artifacts.

The poisoned action and its setup dependency gave the attacker code execution inside the job. Runner telemetry then records a shell script being fetched from a GitHub Gist and run on the Linux runner. Identify the payload filename recorded in the runner telemetry for that execution.

With code running on the runner, the next goal was credential access. Shortly after the payload executed, the runner telemetry shows a tool sweeping the workflow filesystem and process memory for exposed secrets. Identify the secret-scanning tool that was invoked on the Linux runner.

The scanning step surfaced credentials, and the attacker needed to get them out of the ephemeral runner. The GitHub Actions run exposed the harvested secret material directly in the publicly visible workflow logs, obscured rather than left in plaintext. Determine the encoding pattern recorded for that exposed secret data.

Exfiltrating the harvested data required reaching out from the environment. Around the same window, a CloudTrail event on the GitHub API proxy records an AuthorizeSecurityGroupIngress API call that loosened the network controls. Review the SIEM telemetry for that event to determine which source IP address initiated the security-group change.

Having reconstructed the supply-chain compromise end to end, close the loop on detection coverage. A potential breach on the GitHub API proxy was flagged and labeled in the log-management system during the incident. Determine which security monitoring component first ingested and labeled that event, so the team understands where its visibility came from.