Hackerbot-Claw Exploited GitHub Actions in Campaign That Took Over Trivy Repository
Summary
Step Security says hackerbot-claw exploited GitHub Actions workflows at seven repositories through untrusted pull-request code and shell, branch-name and AI prompt injection. It reports stolen Trivy credentials enabled a repository takeover and malicious VS CodeS
Key points
- Step Security says the campaign ran from Feb. 21 to Mar. 2, 2026, targeting at least seven public repositories through pull requests and workflow triggers.
- Techniques included untrusted fork checkouts in pull_request_target workflows, Go init() payloads, direct script injection, and shell injection through filenames and branch names.
- The article reports that workflow logs confirmed code execution and GITHUB_TOKEN exfiltration from avelino/awesome-go; the payload contacted hackmoltrepeat[.]com and sent the token to recv[.]hackmoltrepeat[.]com.
- According to Aqua Security's incident disclosure as summarized in the article, a stolen Trivy PAT was used to privatize and rename the repository, delete releases, and push a suspicious VS Code extension artifact. The repository was restored, while release and download functionality was still being restored.
- Claude Code detected and refused two poisoned CLAUDE.md prompt-injection attempts. In the RustPython attack, branch-name injection reached command substitution, but base64 decoding failed and the full payload did not execute.
- DataDog deployed workflow fixes within about nine hours, including author checks, safer expression handling, and read-only permissions. The article also recommends avoiding privileged workflows that execute untrusted fork code and restricting token permissions and runner network access.
Article Details
- Attack Vectors
- A pull_request_target workflow checked out and executed untrusted fork code with repository secrets or elevated permissions, enabling malicious Go init() code and a Trivy workflow payload to run.
- An attacker injected a curl-to-bash payload directly into project-akri/akri's version.sh, which a comment-triggered workflow ran from fork code.
- Unsanitized attacker-controlled branch names and filenames were interpolated into shell commands, causing command substitution in GitHub Actions workflows.
- A poisoned CLAUDE.md file attempted to manipulate an AI code reviewer into making unauthorized changes; the reviewer detected and refused the instructions.
- A stolen Trivy Personal Access Token was used to push a commit, take over the repository, delete releases, and publish a suspicious VS Code extension artifact.
- Defensive Notes
- Avoid combining pull_request_target with checking out or executing untrusted fork code; use pull_request where appropriate and restrict workflow permissions.
- Pass GitHub expression values through environment variables and safely handle attacker-controlled branch names, filenames, and other shell inputs.
- Require authorization checks such as author_association gates for comment-triggered workflows.
- Apply least-privilege token permissions, using contents: read where write access is unnecessary, and limit access to secrets.
- Restrict AI-review workflows to necessary tools and permissions; avoid allowing all non-write users to trigger workflows with write access.
- Require maintainer review of CLAUDE.md through CODEOWNERS and validate the file against an expected schema in CI.
- Monitor and restrict CI runner outbound network traffic with an egress allowlist to block unauthorized payload downloads and token exfiltration.
- Remove vulnerable workflows, revoke exposed credentials, remove suspicious extension artifacts, and restore or republish affected releases.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hackmoltrepeat[.]com | Attacker-controlled payload-hosting domain used to deliver shell scripts to compromised CI runners. |
| DOMAIN | recv[.]hackmoltrepeat[.]com | Attacker-controlled endpoint used to exfiltrate the GITHUB_TOKEN from a CI runner. |
| URL | hxxps[:]//hackmoltrepeat[.]com/molt | Malicious payload URL repeatedly downloaded and piped to bash in the campaign. |
| URL | hxxps[:]//hackmoltrepeat[.]com/moult | Malicious payload URL embedded in the RustPython branch-name injection attempt. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe RustPython branch-name payload used Base64-encoded shell commands; the DataDog filename injection also used Base64 encoding.T1059.004 · Unix ShellInjected commands executed through bash, including curl-to-bash payloads and shell command substitution in workflow inputs.T1078.004 · Cloud AccountsThe stolen Trivy Personal Access Token was used to push a commit directly to the repository.T1105 · Ingress Tool TransferThe CI payload downloaded and executed attacker-hosted scripts from hackmoltrepeat.com.T1195.002 · Compromise Software Supply ChainAfter taking over the Trivy repository, the attacker reportedly pushed a suspicious artifact to the Open VSX marketplace for its VS Code extension.T1528 · Steal Application Access TokenThe attacker exfiltrated a GITHUB_TOKEN and, in the Trivy incident, stole a Personal Access Token from a vulnerable workflow.T1565.001 · Stored Data ManipulationUsing the stolen token, the attacker altered repository content and deleted GitHub Releases and associated assets.
People
Adnan KhanAlerted the community about the campaign and is identified as a researcher whose prior work on GitHub Actions security informed awareness of CI/CD risks.Thierry AbaléaIndependently verified that several targeted workflows remained vulnerable and reported the issues to affected maintainers.
Vendors
AnthropicThe ambient-code workflow significantly deviated from Anthropic's official claude-code-action documentation. Every configuration choice that enabled this attack vector contradicts the official recommendations:Aqua SecurityAqua Security's Trivy is one of the most widely used open source vulnerability scanners, with 25k+ stars on GitHub and embedded in CI/CD pipelines across thousands of organizations. A cached Google search result revealsGitHubbot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub.StepSecurityThis is what StepSecurity Harden-Runner prevents
Products
Claude CodeThe attacker replaced the repository's CLAUDE.md, a project configuration file that Claude Code loads as trusted context - with social engineering instructions designed to manipulate the AI into performing maliciousGitHub Actionsa GitHub account called hackerbot-claw systematically scanned public repositories for exploitable GitHub Actions workflows. The account describes itself as an "autonomous security research agent powered byHarden-RunnerThis is what StepSecurity Harden-Runner preventsOpen VSXleveraged the compromised access to publish a malicious artifact for Trivy's VS Code extension to the Open VSX marketplace, meaning the attack reached into developer workstations through a tampered IDE extension.Trivyaquasecurity/trivy (full repository compromise)