StepSecurity outlines defenses against Trivy and KICS GitHub Actions compromises
Summary
StepSecurity describes defenses for the reported Trivy and KICS GitHub Actions compromises, including immutable SHA pinning, egress controls, process monitoring, imposter-commit detection, pre-run policies and organization-wide inventory.
Key points
- The article says TeamPCP compromised 76 of 77 aquasecurity/trivy-action version tags and that malware in the action attempted to read secrets from the runner's Runner.Worker process memory.
- It also reports that the Checkmarx KICS GitHub Action was compromised, with malware injected into its Git tags.
- StepSecurity says Harden Runner can block outbound traffic outside an allowlist and detect suspicious process behavior; it cites an attempted connection to scan[.]aquasecurtiy[.]org.
- The post recommends pinning GitHub Actions to immutable commit SHAs to prevent mutable-tag changes from silently changing workflow code.
- StepSecurity describes detecting imposter commits by identifying action SHAs that are not on a branch of the source repository, and cancelling runs that reference known-compromised actions.
- The company says its Actions Inventory can identify repositories using an affected action, show whether references are pinned or mutable, and help scope runs during a compromise window.
Article Details
- Defense Focus
- Protect GitHub Actions workflows from supply-chain compromises by preventing credential theft and exfiltration, detecting anomalous execution, and containing affected runs.
- Detection Methods
- Compare outbound connections with per-workflow baselines and flag new or previously unseen endpoints.
- Monitor runner processes and flag reads of /proc/pid/mem targeting the Runner.Worker process.
- Analyze workflow logs for action commits that resolve to a SHA not present on any branch of the source repository.
- Monitor repositories for unusual tag activity and suspicious commit patterns; validate suspected compromises and collect indicators.
- Use organization-wide detections and Actions Inventory to identify workflows using compromised actions, mutable tags, and runs during the compromise window.
- Data Sources
- Outbound network connections from GitHub Actions workflow runs
- Runner process activity, including process execution and memory-read behavior
- Workflow logs and resolved action commit SHAs compared with source repository branches
- Repository action references, tag usage, and workflow-run timestamps
- Threat intelligence signals from GitHub Actions repositories, package registries, and community channels
- Platforms
- GitHub-hosted runners
- Self-hosted VMs
- Bare-metal runners
- Actions Runner Controller (ARC) clusters
- Defensive Actions
- Enforce network egress allowlists in block mode; use observed endpoints from baseline runs to inform authorized destinations.
- Deploy Harden Runner to monitor network and process behavior; enable process lockdown to isolate the runner and terminate suspicious jobs.
- Pin GitHub Actions to immutable full-length commit SHAs and Docker images to immutable digests.
- Restrict GITHUB_TOKEN permissions to least privilege and replace risky third-party actions with securely maintained alternatives.
- Apply a pre-execution policy that cancels runs referencing known-compromised actions.
- Use the Global Block List to block validated malicious domains and IPs, and use workflow-log analysis to detect imposter commits.
- Use Actions Inventory and workflow-run records to find affected repositories, mutable references, and runs during the compromise window.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Identified as the attacker-controlled C2 domain used to receive stolen credentials from compromised GitHub Actions workflows. |
| IPV4 | 45[.]148[.]10[.]212 | Identified as the attacker IP to which the malicious C2 domain resolves. |
MITRE ATT&CK
T1003.007 · Proc FilesystemThe payload read /proc/pid/mem of the Runner.Worker process to extract secrets from memory.T1041 · Exfiltration Over C2 ChannelThe malware attempted to exfiltrate stolen credentials to an attacker-controlled C2 domain.T1059.006 · PythonThe Trivy payload spawned a Python process to read the Runner.Worker process memory.T1071.001 · Web ProtocolsThe malware attempted to send stolen credentials to its C2 using a POST request.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers compromised GitHub Actions by force-pushing malicious code to existing version tags of aquasecurity/trivy-action and the KICS action.
CVE
Threat Actors
Malware
Vendors
GitHubIn March 2026, attackers turned trusted GitHub Actions into credential stealing weapons. The second Trivy compromise (CVE-2026-33634, CVSS 9.4) saw the threat actor TeamPCP inject a credential stealer into 76 of 77StepSecurityNo single security control stops every variant of these attacks. But the StepSecurity platform is built around the principle of defense in depth: multiple independent security layers, each covering a different phase of
Products
GitHub ActionsIn March 2026, attackers turned trusted GitHub Actions into credential stealing weapons. The second Trivy compromise (CVE-2026-33634, CVSS 9.4) saw the threat actor TeamPCP inject a credential stealer into 76 of 77Harden RunnerHarden Runner: Network Egress Block ModeKICSa credential stealer into 76 of 77 version tags of aquasecurity/trivy-action. Days later, the Checkmarx KICS GitHub Action was compromised with malware injected into all its Git tags. Both attacks followed the sameStepSecurity Maintained ActionsStepSecurity Maintained Actions directly address this risk by providing secure, StepSecurity maintained alternatives to third party actions that have elevated security concerns. StepSecurity onboards actions that haveTrivyIn March 2026, attackers turned trusted GitHub Actions into credential stealing weapons. The second Trivy compromise (CVE-2026-33634, CVSS 9.4) saw the threat actor TeamPCP inject a credential stealer into 76 of 77
Tools
CodeQLrequire cryptographically signed commits and peer review enforcement. Automated security checks including CodeQL, Dependency Review, OpenSSF Scorecard, and GuardDog run on every change.Dependency Reviewsigned commits and peer review enforcement. Automated security checks including CodeQL, Dependency Review, OpenSSF Scorecard, and GuardDog run on every change.GuardDogenforcement. Automated security checks including CodeQL, Dependency Review, OpenSSF Scorecard, and GuardDog run on every change.OpenSSF Scorecardthat have been abandoned by their original developers, rely on a single maintainer, score poorly on OpenSSF Scorecard assessments, or require privileged credential access.trivy-compromise-scanneretc.) receive these alerts in real time. The StepSecurity team also released an open source trivy-compromise-scanner to help the broader community identify affected workflows.