Attackers use GitHub Action to mine cryptocurrency on GitHub servers

by ddos ·

GitHub Actions was discovered to be used by attackers to conduct automated attacks on GitHub’s servers to mine cryptocurrency.

GitHub Actions is a CI/CD solution that can automate all software workflows and set up regular tasks. In this attack, the malicious GitHub Actions code was added to a repository that was forked from a legal repository, and a Pull Request was further created, allowing the original repository maintainer to merge the code back to change the original code. And the malicious code will load a mining program npm.exe from GitLab and run it using the attacker’s wallet address.

According to Dutch security engineer Justin Perdok, the attackers have targeted GitHub repositories that use GitHub Actions to mine cryptocurrencies. Surprisingly, this attack does not require the maintainer of the original project to approve the malicious Pull Request. The malicious attacker merely submits the Pull Request to trigger the attack. This is especially true for GitHub projects that have set up automatic workflows to verify incoming Pull Requests through Action. Once the Pull Request is created for the original project, GitHub’s system will execute the attacker’s code.

Currently, GitHub says that they are aware of the issue and are actively investigating it.

Tags: cryptocurrencycryptocurrency mining malwareGitHub Action