Trivy GitHub Actions Tags Hijacked to Deliver Infostealer Targeting CI/CD Secrets
Summary
Attackers force-pushed 75 trivy-action tags and seven setup-trivy tags with a Python infostealer targeting CI/CD secrets. The incident followed an earlier Trivy compromise; possible TeamPCP involvement remains unconfirmed.
Key points
- Researchers reported that attackers force-pushed 75 version tags in aquasecurity/trivy-action and seven in aquasecurity/setup-trivy to point to malicious commits.
- The Python payload runs on GitHub Actions runners and targets environment variables, credentials, SSH keys, cloud tokens, and cryptocurrency wallet data.
- The payload attempts to send collected data to scan.aquasecurtiy[.]org; if that fails, it can use a captured GitHub PAT to stage data in a public tpcp-docs repository.
- Wiz reported that Trivy version 0.69.4 launched both the legitimate service and malicious code, which can also establish persistence with a systemd service on developer machines.
- Aqua Security said the latest incident followed incomplete containment of an earlier hackerbot-claw compromise; the credential used to rewrite tags remains unclear.
- TeamPCP involvement is possible but unconfirmed. Researchers cited a self-label in the payload and technical overlap, while noting the label could be a false flag.
- Aqua Security advised rotating pipeline secrets if a compromised version may have run. Other guidance includes pinning GitHub Actions to full commit hashes and checking for tpcp-docs repositories.
Article Details
- Victim Organization
- Aqua Security
- Incident Type
- Software supply-chain compromise involving malicious GitHub Actions tags and releases that delivered an infostealer targeting CI/CD secrets.
- Data Types Exposed
- CI/CD environment variables and credentials
- SSH keys
- Cloud service credentials and tokens
- Database, Git, Docker, and Kubernetes credentials
- Cryptocurrency wallet data
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Attackers force-pushed 75 version tags in aquasecurity/trivy-action and seven tags in aquasecurity/setup-trivy to point to malicious commits. A malicious Python infostealer ran in GitHub Actions runners and was designed to harvest secrets, encrypt them, and exfiltrate them. It could also establish persistence with a systemd service on a developer machine. Successful data theft or the number of affected users or repositories was not established in the article.
- Ransom Or Extortion
- No ransom demand or extortion activity tied to this incident was reported. The article describes data theft; its reference to extortion concerns the suspected group's broader activity.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Attacker-controlled server identified as the infostealer's data-exfiltration destination. |
| IPV4 | 45[.]148[.]10[.]212 | IP address associated with the exfiltration domain; recommended by the source for network blocking. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe infostealer encrypted collected data and attempted to exfiltrate it to an attacker-controlled server.T1059.006 · PythonThe malicious infostealer payload was Python-based.T1105 · Ingress Tool TransferA persistent systemd service was configured to poll an external server for a payload to retrieve and execute.T1195.002 · Compromise Software Supply ChainMalicious code was distributed through compromised software supply-chain components: force-pushed tags in the Trivy GitHub Actions.T1543.002 · Systemd ServiceThe payload established persistence on a developer machine using a systemd service.T1552.001 · Credentials In FilesThe payload scanned the runner's file system for credentials and secrets.
People
Itay ShakuryAqua Security's vice president of open source; described the compromised credential and Aqua Security's response.Paul McCartySecurity researcher who flagged the compromised Trivy release version 0.69.4.Philipp BurckhardtSocket security researcher quoted on the tag tampering and the credentials that enabled it.Rami McCarthyWiz researcher who advised pinning GitHub Actions to full SHA hashes rather than movable version tags.
Threat Actors
CipherForceNamed by the article as an alternate name for TeamPCP, which is suspected but not confirmed to be behind the latest attack.hackerbot-clawThe article attributes an earlier Trivy incident to this autonomous bot, which reportedly exploited a pull_request_target workflow to steal a Personal Access Token and take control of the repository. The article says the latest incident stemmed from incomplete containment of that incident.PersyPCPNamed by the article as an alternate name for TeamPCP, which is suspected but not confirmed to be behind the latest attack.TeamPCPPossibly responsible for the latest attack, but attribution is unconfirmed. The payload self-identified as “TeamPCP Cloud stealer”; the article notes this could be a false flag, while citing technical overlap with prior TeamPCP tooling.
Vendors
Aqua SecurityTrivy, the Aqua Security vulnerability scanner, was compromised again to deliver a Python-based infostealer via malicious releases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivyGitHubmalicious releases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivy GitHub Actions, exposing CI/CD secrets and developer credentials.
Products
GitHub Actionsreleases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivy GitHub Actions, exposing CI/CD secrets and developer credentials.Open VSXrelease versions, and push two malicious versions of its Visual Studio Code (VS Code) extension to Open VSX.TrivyTrivy, the Aqua Security vulnerability scanner, was compromised again to deliver a Python-based infostealer via malicious releases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivyVSCodeof the GitHub repository, delete several release versions, and push two malicious versions of its Visual Studio Code (VS Code) extension to Open VSX.