StepSecurity Adds GitHub Actions Policy and Detection for Secret Exfiltration

Summary

StepSecurity announced a policy to block unreviewed GitHub Actions workflows from accessing secrets and a detection for exfiltration attempts. The article describes four campaigns that used injected workflows to steal credentials.

Key points

The article describes GhostAction, Megalodon, Miasma and Hades campaigns involving compromised accounts or tokens and malicious workflow files.
StepSecurity reports that GhostAction reached 817 repositories and stole 3,325 secrets; these figures are presented as campaign findings in the article.
The article says Hades used a GitHub token to add a workflow that serialized repository secrets, uploaded them as an artifact, then deleted the run and branch.
The announced Secret Exfiltration Policy blocks unreviewed workflows or workflow changes from accessing secrets, subject to explicit approval.
The announced detection looks for a combination of indicators, including workflow names, toJSON(secrets), commit-message patterns and exfiltration artifacts.
StepSecurity says detections identify the affected repository, matched indicators and the relevant workflow location; alerts can be enabled in notification settings.

Article Details

Event Type: Announcement of secret-exfiltration prevention and detection features for GitHub Actions workflows.
Impact: The article describes attacks in which malicious workflows use CI runners to access and exfiltrate repository secrets. It reports that GhostAction reached 327 users across 817 repositories and stole 3,325 secrets, and that Megalodon injected workflows into more than 5,500 repositories. StepSecurity says its policy can block unreviewed workflows from accessing secrets and its detection can flag suspected exfiltration attempts.

Threat Actors

HadesThe article identifies Hades and Miasma as the same evolving threat actor. It reports that Hades used a GitHub token to commit workflows that dumped repository secrets into an artifact, then downloaded the artifact and deleted the run and branch.MiasmaThe article identifies Miasma and Hades as the same evolving threat actor. It says Miasma planted configuration files that ran a credential harvester when a repository was opened in an AI coding tool.

Vendors

GitHubattacks of the past year share a step that almost no one watches. After an attacker steals a developer's GitHub token, they do not stop at that one machine. They use the token to commit a GitHub Actions workflow into StepSecuritywhy branch protection and code review keep missing the workflow file, and shows the two layers StepSecurity uses to stop it: a policy that blocks unreviewed workflows from touching your secrets, and a detection

Products

GitHub Actionsa developer's GitHub token, they do not stop at that one machine. They use the token to commit a GitHub Actions workflow into your repositories, let your own CI runner read every secret you have, and walk the Harden-Runnerrolling out or running in audit mode. That is the new Secret Exfiltration Attempt detection on the Harden-Runner Detections page.