Six Accounts, One Actor: Inside the prt-scan Supply-Chain Campaign
Summary
Wiz Research traced six waves of a campaign abusing GitHub’s pull_request_target workflows to steal credentials and compromise at least two npm packages. The actor opened over 500 malicious PRs, with a reported success rate below 10%.
Key points
- The campaign began March 11, 2026, and used six GitHub accounts to open more than 500 malicious pull requests across six waves.
- The attacker abused pull_request_target workflows, which run in the base repository context and may expose repository secrets to pull requests from forks.
- Payloads evolved from shell scripts to repository-aware, AI-generated injections targeting files such as conftest.py, package.json, Makefile, and build.rs.
- Across more than 450 analyzed attempts, fewer than 10% succeeded; the research reports at least two compromised npm packages and credential theft involving AWS, Cloudflare, and Netlify tokens.
- Many attempted payload stages required permissions the stolen tokens did not have, while contributor approval gates and workflow restrictions blocked attacks against several high-profile repositories.
- The article recommends reviewing repositories for the listed account names, prt-scan branch pattern, pull-request signatures, and workflow-log markers.
Article Details
- Attack Vectors
- Exploited GitHub Actions workflows using the pull_request_target trigger, which runs in the base repository context and may expose repository secrets to pull requests from forks.
- Opened malicious pull requests containing payloads in CI-executed files, including conftest.py, package.json, Makefile, setup.py, build.rs, action.yml, and workflow-directory scripts.
- Sought to steal GitHub tokens and secrets from workflow environment variables, git configuration, workflow logs, and later-running processes; probed cloud metadata endpoints and attempted to exfiltrate credentials through workflow logs and pull-request comments.
- Attempted to publish malicious versions of npm packages when an NPM_TOKEN was available; the article reports confirmed compromise of @codfish/eslint-config and @codfish/actions.
- Defensive Notes
- Require approval for first-time contributors and restrict privileged workflows to trusted actors.
- Use path-based trigger conditions and review pull_request_target workflows for unsafe execution of pull-request content.
- Review GitHub organizations for the article's listed account names, branch pattern, pull-request signatures, user agent, and workflow-log markers.
- The article reports that contributor approval requirements, actor-restricted workflows, and path-based trigger conditions blocked attacks against several high-profile repositories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
elzotebo@proton[.]me | Email associated with the GitHub account elzotebo, identified as part of the campaign. | |
elzotebo+88@proton[.]me | Email associated with the GitHub account ezmtebo, identified as part of the campaign. | |
testedbefore@proton[.]me | Email associated with the GitHub account testedbefore, identified as part of the campaign. | |
testedbefore+55@proton[.]me | Email associated with the GitHub account 420tb, identified as part of the campaign. | |
testedbefore+89@proton[.]me | Email associated with the GitHub account beforetested-boop, identified as part of the campaign. | |
testedbefore+99@proton[.]me | Email associated with the GitHub account 69tf420, identified as part of the campaign. | |
| IPV4 | 169[.]254[.]169[.]254 | Cloud metadata address probed by campaign payloads for credential access. |
MITRE ATT&CK
T1059.004 · Unix ShellCampaign payloads used bash scripts and shell commands in CI-executed files.T1195.002 · Compromise Software Supply ChainThe actor compromised npm packages by publishing malicious versions of @codfish/eslint-config and @codfish/actions.T1528 · Steal Application Access TokenThe payload extracted GitHub tokens from git configuration and attempted to use stolen tokens for API access.T1552.001 · Credentials In FilesPayloads searched process environments and workflow configuration for secrets and credentials, including AWS_SECRET_ACCESS_KEY.T1557.003 · DHCP SpoofingThe payload probed cloud instance metadata endpoints, including 169.254.169.254, for credentials.T1567 · Exfiltration Over Web ServiceThe payload exfiltrated credentials through workflow logs and pull-request comments.
People
Threat Actors
420tbGitHub account identified as part of the campaign's March 28 wave.69tf420GitHub account identified as part of the campaign's March 28–29 wave.beforetested-boopGitHub account identified as part of the campaign's second wave.elzoteboGitHub account identified as part of the campaign's April 2 wave.ezmteboGitHub account identified as part of the campaign's April 2–3 wave and the publicly reported activity.testedbeforeGitHub account identified as part of the campaign's earliest wave.