How Attackers Use GitHub PATs to Move from Repositories into Cloud Environments
Summary
Wiz CIRT describes incidents where attackers used compromised GitHub PATs to find Actions secrets, run malicious workflows, obtain cloud credentials, move into cloud environments and delete evidence. The article also highlights audit-log gaps and investigation steps.
Key points
- Wiz CIRT reports multiple incidents in which attackers used compromised GitHub PATs with standard developer permissions to abuse trust between repositories and cloud accounts.
- Attackers can search repository code for GitHub Actions secret names even without admin-level access to enumerate the secrets themselves.
- With write permissions, a compromised PAT can be used to create workflows that run attacker-controlled code and access Actions secrets.
- Wiz observed attackers bypassing GitHub’s secret masking by encoding secret values multiple times, or exfiltrating them to attacker-controlled webhooks.
- Attackers used obtained cloud credentials for lateral movement and, in some cases, created new cloud keys for persistent access.
- PATs with write scopes can also be used to delete workflow logs, runs, pull requests and branches, hindering investigation.
- Wiz says code-search API calls are not logged and IP tracking is opt-in; it recommends real-time enterprise audit-log streaming and enabling IP tracking for investigations.
Article Details
- Attack Vectors
- Attackers use compromised GitHub Personal Access Tokens (PATs) to search repository code for GitHub Actions secret names, then create or modify workflows to access those secrets.
- PATs with write permissions can be used to create workflows and pull requests that run attacker-controlled code on GitHub Actions, with results retrieved from workflow logs.
- Attackers can bypass GitHub Actions secret masking by encoding a secret twice with Base64, or exfiltrate secrets to an attacker-controlled webhook endpoint.
- Cloud credentials obtained through Actions secrets can be used to create additional cloud credentials and move laterally into the victim's cloud environment.
- Attackers may use a compromised PAT to delete workflow logs, workflow runs, pull requests, and branches to hinder investigation.
- The article describes the tj-actions/changed-files supply-chain attack as involving a malicious payload that leaked secrets from affected repositories into logs.
- Defensive Notes
- Grant principals associated with GitHub Actions secrets the minimum permissions necessary and manage stored cloud credentials cautiously.
- Enable real-time GitHub Enterprise audit log streaming and opt-in IP tracking to preserve API request details for investigations.
- Use secret scanning across repository code, Git history, and branches; rotate or revoke exposed secrets.
- Prevent secrets from being committed with pre-commit hooks, IDE extensions, and CI/CD or VCS scanning.
- Monitor abnormal PAT behavior, unusual Actions usage, high-volume activity, and workflow-based secret exfiltration.
MITRE ATT&CK
T1021 · Remote ServicesThe article describes using obtained cloud keys for cross-cloud lateral movement into the target's cloud infrastructure.T1041 · Exfiltration Over C2 ChannelAttackers exfiltrate secrets through workflow logs or to a webhook endpoint they control.T1059.004 · Unix ShellAttacker-created GitHub Actions workflows execute shell commands, including commands to print and encode secrets.T1070.004 · File DeletionAttackers with write-scoped PATs can delete workflow logs, workflow runs, pull requests, and created branches to hinder investigation.T1078 · Valid AccountsAttackers use stolen cloud credentials and newly created cloud keys for access to the victim's cloud environment.T1098.001 · Additional Cloud CredentialsAttackers can use a compromised cloud credential to create a new cloud access key for the same user.T1552.001 · Credentials In FilesAttackers search repository code for GitHub Actions secret names and obtain hard-coded or stored cloud credentials.T1557 · Adversary-in-the-MiddleThe article reports that attackers can exfiltrate secrets to a webhook endpoint they control; no endpoint is provided.T1567 · Exfiltration Over Web ServiceIn the tj-actions/changed-files supply-chain attack, a malicious payload leaked secrets in GitHub logs.
People
Vendors
GitHubThreat actors are targeting GitHub Personal Access Tokens (PAT) as high-value entry points, leveraging compromised PATs to gain initial access to victim cloud environments. Historically, compromised PATs were used toWizcompromised PATs were used to identify and obtain secrets hard-coded in source code. However, the Wiz Customer Incident Response Team (Wiz CIRT) recently responded to multiple incidents where threat actors
Products
GitHub ActionsNext, if the PAT has write permissions, attackers can leverage the GitHub Actions platform to execute malicious code. GitHub Enterprisebe monitored as these search API calls are not logged, despite contradictory claims in current GitHub Enterprise audit logs documentation. Wiz is currently working with GitHub support to resolve this discrepancy.Wiz Defendthe full scope of an incident, an organization needs to see exactly what API calls the attacker made. Wiz Defend enables this by supporting GitHub Enterprise log streaming and presenting these logs in the CloudWiz Secret ScannerAdditionally, the Wiz Secret Scanner detects cloud keys and other secrets across the entire codebase, including Git history and all branches. This detection helps identify and track secrets that should be rotated or