How to Detect Compromised GitHub Actions Through CI Runner Telemetry
Summary
The article uses the Trivy GitHub Actions compromise to explain how Tetragon telemetry can reveal CI runner attacks, and provides detection ideas and hardening measures for credential theft, persistence and exfiltration.
Key points
- The article describes a March 2026 compromise of aquasecurity/trivy-action and aquasecurity/setup-trivy, attributed to TeamPCP, in which affected version tags were repointed to commits containing credential-stealing code.
- The described payloads targeted secrets in Runner.Worker memory and credentials on self-hosted runner filesystems, then staged and exfiltrated collected data.
- Tetragon can capture process, file and network activity on hosted, self-hosted and Kubernetes-based runners; the article provides sample tracing policies and configuration.
- Detection examples include cross-process reads of /proc memory, access to multiple sensitive files, decoded scripts piped to interpreters, and processes operating on temporary staging directories.
- Another detection identifies changes to RUNNER_TRACKING_ID that can let processes persist beyond a job’s cleanup.
- Recommended defenses include pinning Actions to full commit SHAs, limiting workflow permissions and secret exposure, using ephemeral runners, and rotating credentials if compromise is suspected.
Article Details
- Defense Focus
- Detect and contain CI runner compromises, especially process-memory and filesystem credential harvesting, staged data exfiltration, and attempts to persist beyond a job.
- Detection Methods
- Alert on cross-process reads of /proc/<pid>/mem and correlate the target PID with Runner.Worker process ancestry.
- Detect reads of multiple distinct sensitive credential files within a short time window using distinct file.path counts.
- Correlate base64 decoding with a shell or script interpreter execution by shared parent process and workflow run ID within one minute.
- Detect multiple distinct processes referencing a /tmp/tmp. staging directory, optionally including forked processes by removing parent-PID grouping.
- Detect RUNNER_TRACKING_ID values that lack the expected github_ prefix.
- Monitor outbound shell connections consistent with reverse shells and curl connections using file-upload or data-post flags.
- Correlate process access to /proc/<pid>/maps or /proc/<pid>/environ across multiple processes within a short window.
- Data Sources
- Process execution events, command lines, and process ancestry
- File-access events, including reads of /proc/<pid>/mem, /proc/<pid>/maps, /proc/<pid>/environ, sensitive credential files, and temporary paths
- Network connection events
- Process environment variables limited to RUNNER_TRACKING_ID
- Workflow metadata including run, job, step, repository, and trigger
- Host name and workflow run or agent ID for event correlation
- Rule Types
- Tetragon YAML tracing policies using kprobes for TCP connections and file access
- Correlated process-event detections using parent PID, target PID, host, and workflow run ID
- Time-window aggregations using distinct file paths or distinct processes
- Process command-line and environment-variable pattern matching
- Abstract CI/CD runtime detection rules
- Platforms
- Tetragon
- Abstract
- GitHub Actions runners, including self-hosted and ephemeral runners
- Actions Runner Controller (ARC) Kubernetes deployments
- Defensive Actions
- Pin third-party Actions to full commit SHAs and allow only audited, approved Actions.
- Set explicit minimum permissions for each workflow.
- Limit secrets to the steps that need them; use a dedicated secret manager and prefer short-lived cloud tokens.
- Avoid pull_request_target workflows where possible and do not check out untrusted pull-request code in workflows that hold secrets.
- Keep self-hosted runners off public repositories or require approval for outside collaborators; prefer ephemeral runners and keep credentials off runner hosts.
- Audit runner access to internal services and sensitive infrastructure.
- If a workflow may have been compromised, rotate every credential it could reach and review cloud audit logs for signs of misuse.
MITRE ATT&CK
T1003.007 · Proc FilesystemThe payload locates Runner.Worker, reads its memory through /proc/<pid>/mem, and scans the dump for decrypted workflow secrets.T1059.004 · Unix ShellThe article describes shell-based decode-and-execute behavior and detections for bash reverse-shell patterns.T1059.006 · PythonThe injected action decodes and pipes a Python credential-harvesting script to an interpreter.T1070.004 · File DeletionThe script uses rm to remove residual files and temporary folders after its activity.T1074.001 · Local Data StagingCollected secrets are staged in a temporary directory before encryption, archiving, and exfiltration.T1140 · Deobfuscate/Decode Files or InformationThe injected script decodes base64-encoded Python payloads at runtime before execution.T1552.001 · Credentials In FilesThe self-hosted runner variant searches filesystem locations for stored credentials, including configuration files, keys, and other secrets.T1552.005 · Cloud Instance Metadata APIThe article says the harvesting script attempts to query AWS ECS credentials and EC2 IMDSv1.T1552.007 · Container APIThe script can run kubectl to fetch Kubernetes secrets using access available from the runner.T1560.001 · Archive via UtilityThe collected data is encrypted and archived before it is exfiltrated.T1567.001 · Exfiltration to Code RepositoryAs a fallback exfiltration method, the script creates a public repository and uploads stolen data as a release asset.
Threat Actors
Products
AbstractGetting visibility into CI runner activity using Abstract and TetragonGitHub Actionswith the Abstract platform and Tetragon with its rich telemetry. Using actual payloads from the Trivy GitHub Actions compromise, we’ll analyze CI runner attacks through the lens of that telemetry and showcaseTrivycomponents and dependencies that CI/CD pipelines rely on. From Shai-Hulud, reviewdog, tj-actions, and Trivy compromises to Megalodon, Mini Shai-Hulud and its Miasma offshoot - campaigns targeting the pipeline have
Tools
curlout of the workflow. The collection file is staged, encrypted, archived, and exfiltrated over HTTP via curl. Note the reference to a temp directory in every stage.kubectlSome parts perform more active harvesting by attempting to query the AWS ECS credential endpoint and EC2 IMDSv1 and running utilities like kubectl to fetch secrets.TetragonGetting visibility into CI runner activity using Abstract and Tetragon