Spoofed Dependabot commits and secret-stealing Actions

T0112 · Initial Access · Compromised Token

The perpetrators managed to acquire personal GitHub tokens, although the method of compromise remains unclear. Given the widespread nature of the attack across numerous unrelated repositories, it is likely that compromised developer workstations played a role.

T0153 · Initial Access · Compromised Developer Workstation

The attackers managed to acquire personal GitHub tokens, although the method of compromise remains unclear. Given the widespread nature of the attack across numerous unrelated repositories, it is likely that compromised developer workstations played a role.

T0195 · Defense Evasion · Spoofed Commits

The attackers commits aimed to evade detection by adopting the guise of 'Dependabot,' a tool from GitHub designed to tackle security vulnerabilities in third-party libraries.

T0167 · Persistence · Recursive PR

Malicious PRs impersonating Dependabot were opened at scale so that
auto-merge or hurried review would land the payload and the next
victim's secrets.

T0140 · Credential Access · Harvest Tokens From Environment Variables

Attackers pushed a Github action definition that was configured to execute per push and send GitHub secrets and variables to a command and control server. This has the potential to compromise more resources from code to cloud.

T0196 · Impact · Backdoor in code

Attackers also infected Javascript files with a password stealing malware.

T0113 · Initial Access · Compromised user account

Once the JavaScript code designed to steal passwords is deployed, it initiates another phase of the attack. Not only can it be utilized to pilfer data, but it also serves as a potential gateway for launching another supply chain attack on the affected users' audience.