hackerbot-claw autonomous GitHub Actions exploitation

GitHub Actions Git / GitHub AI coding agents VS Code / IDE

StepSecurity documented hackerbot-claw, an account describing itself as
an autonomous security-research agent on Claude Opus, scanning public
repos for exploitable GitHub Actions and opening PRs. Hits included
avelino/awesome-go (poisoned Go script / token theft), Microsoft,
Datadog, CNCF projects, ambient-code/platform (prompt injection into
project instructions), and aquasecurity/trivy (stolen PAT later used
toward the Trivy VS Code extension on Open VSX). Common tell: outbound
curl to hackmoltrepeat.com from the CI runner. No human weekend
operator — continuous bot. StepSecurity, with independent verification
by Thierry Abaléa (Shipfox).

Mapped techniques

T0147 Scan public CI/CD configurations for secrets and vulnerable actions
T0118 Command injection
T0166 Trigger pipeline execution
T0140 Harvest tokens from environment variables
T0210 Poison AI coding-agent config or workspace
T0156 Exfiltration over webhooks
T0143 External user accounts

supply-chain autonomous gha exploitation

T0147 · Reconnaissance · Scan public CI/CD configurations for secrets and vulnerable actions

Bot scanned public workflows for injection and secret-leak bugs.

T0118 · Execution · Command injection

PRs that executed attacker code in privileged workflows.

T0166 · Execution · Trigger pipeline execution

PRs and workflow runs as the execution path.

T0140 · Credential Access · Harvest tokens from environment variables

Stolen PATs (Trivy and others).

T0210 · Persistence · Poison AI coding-agent config or workspace

Project-level instruction injection on ambient-code/platform.

T0156 · Exfiltration · Exfiltration over webhooks

Outbound curl to hackmoltrepeat.com from CI.

T0143 · Initial Access · External user accounts

Autonomous external account opened the PRs.

Sources

https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation