Poisoned Pipeline / Techniques / T0148
Scheduled tasks on self hosted runner
CI/CD Posture
In this attack, the attacker gains access to a self-hosted runner, which is a server or a virtual machine that runs the CI/CD pipelines for an organization.
Once access is gained, the attacker creates a scheduled task or job that runs at regular intervals, even after the initial attack has been detected and removed.
The scheduled task or job can be programmed to perform a variety of malicious activities, such as downloading and executing additional malware or maintaining a persistent backdoor for future attacks.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1480 Limit the privileges of the runner
- M1481 Avoid using self-hosted runners for public repositories
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (4)
- Self-hosted GitHub Actions runners (Praetorian Gato)
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure
- Microsoft counterfeit-installer campaign — same-named archives regenerate server-side per download