Codecov Breach

T0103 · Reconnaissance · Scan Public Artifacts For Secrets

The attackers scanned Docker Hub and discovered git credentials in the official Codecov image

T0142 · Reconnaissance · Accidental Public Disclosure Of Internal Resources

The git credentials was in-deliberately saved in the public docker image

T0114 · Initial Access · Compromised Service Account

The attackers gained access to Codecov's Git repo

T0191 · Impact · Malicious Code In Artifacts

The Bash Uploader script was modified to exfiltrate environment variables of the running system

T0118 · Execution · Command Injection

When the Codecov image was executed - the malicious implant in the Bash Uploader script exfiltrated environment variable to the attacker controlled

T0122 · Initial Access · Vulnerability In Third-Party CI/CD Actions

The Bash Uploader script was used as part of 3rd party Github actions

T0140 · Credential Access · Harvest Tokens From Environment Variables

T0121 · Resource Development · Compromised Legitimate Artifact

T0159 · Execution · Malicious Artifact Execution

Customers that utilized the Codecov image were impacted

T0207 · Defense Evasion · Skip or forge artifact integrity verification

Customers ran the Bash Uploader as a curl-to-pipe helper with no
signature or checksum pin, so the rewritten script executed as Codecov.

T0185 · Credential Access · Steal credentials in container artifacts

Git credentials were left in the public Codecov Docker image — the
initial secret that unlocked the Bash Uploader rewrite.

T0192 · Collection · Sensitive information in logs

The modified uploader exfiltrated CI environment data that often
also lands in build logs.