GitHub CI Secret Stealer Campaign: 4,837 Compromised Accounts Targeting Cloud Credentials — Detection and Remediation Guide

---
title: Suspicious GitHub Actions Workflow Modification
id: 9c2e8f4a-1d3b-4e7f-9a1c-5b8d2e6f3a7c
status: experimental
description: Detects modifications to GitHub Actions workflow files that introduce curl, wget, or base64-encoded commands commonly used for secret exfiltration.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/11/01
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/.github/workflows/'
      - '\.github\workflows\'
  selection_extension:
    TargetFilename|endswith:
      - '.yml'
      - '.yaml'
  selection_content:
    FileContent|contains:
      - 'curl'
      - 'wget'
      - 'base64'
      - 'nc '
      - '/dev/tcp/'
  condition: selection_path and selection_extension and selection_content
falsepositives:
  - Legitimate CI workflows that download dependencies or upload artifacts
  - Workflows using curl for API calls to known services
level: high
---
title: CI Workflow Secret Access via Environment Variables
id: 4f7a9c1e-2b5d-4f8a-9c3e-7d1a6b4f8e2c
status: experimental
description: Detects processes accessing common CI/CD environment variables containing secrets, cloud credentials, or tokens.
references:
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/11/01
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'AWS_ACCESS_KEY_ID'
      - 'AWS_SECRET_ACCESS_KEY'
      - 'AZURE_CLIENT_SECRET'
      - 'GCP_SERVICE_ACCOUNT_KEY'
      - 'GITHUB_TOKEN'
      - 'NPM_TOKEN'
      - 'PYPI_TOKEN'
      - 'DOCKER_PASSWORD'
  condition: selection
falsepositives:
  - Legitimate build scripts that reference environment variables
  - CI/CD configuration and debugging
level: medium
---
title: Outbound HTTP Request from CI Runner to Unknown Domain
id: 8e3d5f2a-9c1b-4e7d-8f4a-6b2c9e1d5f7a
status: experimental
description: Detects outbound HTTP/HTTPS requests from CI runner processes to external domains not matching known package registries or cloud provider endpoints.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/11/01
tags:
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/Runner.Worker'
      - '/Runner.Listener'
      - '/node'
      - '/python'
      - '/curl'
      - '/wget'
  selection_network:
    DestinationPort:
      - 80
      - 443
  filter_github:
    DestinationHostname|endswith:
      - '.github.com'
      - '.githubusercontent.com'
      - '.npmjs.org'
      - '.pypi.org'
      - '.amazonaws.com'
      - '.azure.com'
      - '.googleapis.com'
  condition: selection_process and selection_network and not filter_github
falsepositives:
  - Legitimate downloads from third-party CDNs or APIs
  - Custom artifact repositories
level: medium

// Hunt for GitHub Actions workflow modifications introducing suspicious commands
// This query targets Syslog ingestion from Linux runners or auditd logs
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any (".github/workflows", "workflow_dispatch")
| where SyslogMessage has_any ("curl", "wget", "base64", "nc ", "/dev/tcp/")
| extend WorkflowFile = extract(@"([^\s]+\.ya?ml)", 1, SyslogMessage)
| extend SuspiciousCommand = extract(@"(curl|wget|base64|nc|/dev/tcp/)[^\s]*", 0, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, WorkflowFile, SuspiciousCommand, SyslogMessage
| order by TimeGenerated desc

// Hunt for processes accessing CI/CD environment variables
// Requires command-line auditing enabled on Linux runners
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where CommandLine has_any ("AWS_ACCESS_KEY_ID", "AZURE_CLIENT_SECRET", "GITHUB_TOKEN", "NPM_TOKEN")
| where Process !in ("bash", "sh", "zsh")  // Filter out interactive shells
| project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName
| order by TimeGenerated desc

// Network connections from CI runners to non-standard domains
// Assumes Syslog or firewall logs ingested via CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where ApplicationProtocol in ("HTTP", "HTTPS")
| where SourceProcessName has_any ("Runner.Worker", "Runner.Listener", "node", "python", "curl")
| where not(DestinationHostName has_any ("github.com", "npmjs.org", "pypi.org", "amazonaws.com", "azure.com", "googleapis.com"))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName, DestinationPort, SourceProcessName
| where ConnectionCount > 5
| order by FirstSeen desc

-- Hunt for suspicious GitHub Actions workflow files modified in the last 7 days
-- and containing common exfiltration commands

LET workflow_files = SELECT FullPath, Mtime, Size,
    read_file(filename=FullPath, length=50000) AS Content
FROM glob(globs='*/.github/workflows/*.y*ml', root='/')
WHERE Mtime > (now() - 7 * 24 * 3600)  -- Modified in last 7 days

LET suspicious_workflows = SELECT FullPath, Mtime,
    Content =~ '(curl|wget|base64|nc |/dev/tcp/)' AS HasSuspiciousCommand,
    Content
FROM workflow_files
WHERE HasSuspiciousCommand

-- Also check for processes with CI-related environment variables
LET suspicious_processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(AWS_ACCESS_KEY_ID|AZURE_CLIENT_SECRET|GITHUB_TOKEN|NPM_TOKEN)'

SELECT 'Workflow' AS ArtifactType, FullPath AS Indicator, Mtime AS Timestamp, Content AS Details
FROM suspicious_workflows
UNION ALL
SELECT 'Process' AS ArtifactType, Name AS Indicator, CreateTime AS Timestamp, CommandLine AS Details
FROM suspicious_processes

#!/bin/bash
# GitHub CI/CD Secret Stealer Detection and Remediation Script
# Run this on self-hosted runners and development workstations

set -euo pipefail

echo "======================================"
echo "GitHub CI Secret Stealer Detection"
echo "======================================"
echo

# Color codes for output
RED='\033[0;31m'
YELLOW='\033[1;33m'
GREEN='\033[0;32m'
NC='\033[0m' # No Color

# Check 1: Scan for recently modified workflow files with suspicious content
echo "[1] Scanning for suspicious workflow file modifications..."
SUSPICIOUS_WORKFLOWS=$(find . -type f \( -name "*.yml" -o -name "*.yaml" \) -path "*/.github/workflows/*" -mtime -7 -exec grep -l -E "(curl|wget|base64|nc |/dev/tcp/)" {} \; 2>/dev/null || true)

if [ -n "$SUSPICIOUS_WORKFLOWS" ]; then
    echo -e "${RED}[!] ALERT: Found suspicious workflow files modified in last 7 days:${NC}"
    echo "$SUSPICIOUS_WORKFLOWS" | while read -r file; do
        echo "    - $file"
        echo "      Suspicious commands found:"
        grep -E "(curl|wget|base64|nc |/dev/tcp/)" "$file" | sed 's/^/        /'
    done
    echo
    echo -e "${YELLOW}ACTION REQUIRED: Review these files for unauthorized modifications${NC}"
else
    echo -e "${GREEN}[✓] No suspicious workflow modifications detected${NC}"
fi
echo

# Check 2: Audit GitHub Actions runner processes
echo "[2] Checking for running GitHub Actions runner processes..."
RUNNER_PROCESSES=$(ps aux | grep -E "(Runner\.Worker|Runner\.Listener)" | grep -v grep || true)

if [ -n "$RUNNER_PROCESSES" ]; then
    echo -e "${YELLOW}[!] GitHub Actions runner processes detected:${NC}"
    echo "$RUNNER_PROCESSES"
    echo
    echo "Checking runner environment for exposed secrets..."
    
    # Check if any runner processes have sensitive env vars (requires root)
    if [ "$EUID" -eq 0 ]; then
        for pid in $(echo "$RUNNER_PROCESSES" | awk '{print $2}'); do
            if [ -r "/proc/$pid/environ" ]; then
                echo "  PID $pid environment:"
                cat "/proc/$pid/environ" 2>/dev/null | tr '\0' '\n' | grep -E "(TOKEN|SECRET|KEY|PASSWORD)" | sed 's/=.*/=<REDACTED>/' | sed 's/^/    /' || true
            fi
        done
    else
        echo "  (Run as root to inspect process environments)"
    fi
else
    echo -e "${GREEN}[✓] No GitHub Actions runner processes found${NC}"
fi
echo

# Check 3: Scan for exposed credentials in environment variables
echo "[3] Checking current environment for exposed CI/CD secrets..."
EXPOSED_SECRETS=$(env | grep -E "(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AZURE_CLIENT_SECRET|GCP_SERVICE_ACCOUNT|GITHUB_TOKEN|NPM_TOKEN|PYPI_TOKEN)" | cut -d= -f1 || true)

if [ -n "$EXPOSED_SECRETS" ]; then
    echo -e "${YELLOW}[!] WARNING: CI/CD secrets found in current environment:${NC}"
    echo "$EXPOSED_SECRETS" | sed 's/^/    - /'
    echo
    echo -e "${YELLOW}RECOMMENDATION: Rotate these credentials immediately if runner is compromised${NC}"
else
    echo -e "${GREEN}[✓] No exposed CI/CD secrets in current environment${NC}"
fi
echo

# Check 4: Network connections to suspicious destinations
echo "[4] Checking for outbound connections from CI processes..."
if command -v netstat &> /dev/null; then
    SUSPICIOUS_CONNECTIONS=$(netstat -tunp 2>/dev/null | grep -E "(node|python|curl|wget)" | grep -E ":80 |:443 " | grep -v -E "(github|npmjs|pypi|amazonaws|azure|googleapis)" || true)
    
    if [ -n "$SUSPICIOUS_CONNECTIONS" ]; then
        echo -e "${YELLOW}[!] Outbound connections to non-standard destinations:${NC}"
        echo "$SUSPICIOUS_CONNECTIONS"
    else
        echo -e "${GREEN}[✓] No suspicious outbound connections detected${NC}"
    fi
else
    echo "  (netstat not available - skipping network check)"
fi
echo

# Check 5: Audit git log for suspicious commits
echo "[5] Checking recent git history for workflow file changes..."
if [ -d ".git" ]; then
    WORKFLOW_COMMITS=$(git log --all --oneline --since="7 days ago" -- ".github/workflows/" 2>/dev/null || true)
    
    if [ -n "$WORKFLOW_COMMITS" ]; then
        echo -e "${YELLOW}[!] Workflow files modified in recent commits:${NC}"
        echo "$WORKFLOW_COMMITS" | sed 's/^/    /'
        echo
        echo "Review commit authors and changes:"
        git log --all --since="7 days ago" --format="%h %an %ae %s" -- ".github/workflows/" 2>/dev/null | sed 's/^/    /' || true
    else
        echo -e "${GREEN}[✓] No recent workflow file modifications in git history${NC}"
    fi
else
    echo "  (Not a git repository - skipping git history check)"
fi
echo

# Check 6: Recommendations
echo "======================================"
echo "REMEDIATION RECOMMENDATIONS"
echo "======================================"
echo
echo "If compromise is suspected:"
echo "1. Rotate ALL secrets accessible to affected repositories:"
echo "   - GitHub Personal Access Tokens (PATs)"
echo "   - Cloud provider credentials (AWS, Azure, GCP)"
echo "   - Package registry tokens (npm, PyPI, Docker Hub)"
echo "   - Database credentials and API keys"
echo
echo "2. Review GitHub Audit Logs:"
echo "   gh api /orgs/YOUR_ORG/audit-log --jq '.[] | select(.action==\"repo.access\" or .action==\"workflows.update_workflow\")'"
echo
echo "3. Enable GitHub Advanced Security features:"
echo "   - Secret scanning"
echo "   - Push protection for secrets"
eecho "   - Dependency review"
echo
echo "4. Implement workflow security controls:"
echo "   - Require code review for workflow changes"
echo "   - Use OpenID Connect (OIDC) for cloud authentication"
echo "   - Minimize use of long-lived credentials"
echo "   - Enable branch protection rules"
echo
echo "5. Audit third-party integrations:"
echo "   - Review OAuth apps with repository access"
echo "   - Revoke unused or suspicious integrations"
echo "   - Limit GitHub App permissions to minimum required"
echo

echo "======================================"

# GitHub CLI commands for audit log review
gh api /orgs/YOUR_ORG/audit-log --jq '.[] | select(.created_at > "2026-10-25")' > audit_log.json

# Look for suspicious workflow modifications
gh api /orgs/YOUR_ORG/audit-log --jq '.[] | select(.action=="workflows.update_workflow" or .action=="workflows.create_workflow")'

# Check for unusual repository access patterns
gh api /orgs/YOUR_ORG/audit-log --jq '.[] | select(.action=="repo.access") | {user: .actor, repo: .repo, time: .created_at}'

# Example GitHub Actions workflow using OIDC for AWS
name: Deploy to AWS
on: [push]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: us-east-1
      # No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY needed!

# Require security team review for workflow changes
/.github/workflows/ @your-org/security-team

# Require DevOps review for CI configuration
/.github/actions/ @your-org/devops-team