Tool
GitHub Actions
- First Reported
- Jul 8, 2025
- Latest Reported
- Jun 26, 2026
Reported Context (2)
- Recent variants have abused trusted OIDC publishing in GitHub Actions, producing artifacts that appear legitimately attested even though the runner itself was attacker-influenced. Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theft
- Where it is automatically linted and tested via our CI pipeline, leveraging GitHub actions Splunk Threat Research Lead on Threat Hunting, Detection Engineering and Living-Off-the-Land Risks
Malware (3)
People (3)
Threat Actors (1)
MITRE ATT&CK (11)
Vendors (5)
Products (11)
Tools (13)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.