Poisoned Pipeline / Techniques / T0168

T0168 · Exfiltration · TA11 · observed in 9 incident(s)

Exfiltration to code repositories

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.
Code repositories are often accessible via an API (ex: https://api.github.com, https://gitlab.com/api). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Where this idea came from

ATT&CK / AppSec analog

Analog of a well-known ATT&CK or AppSec technique, applied to software supply chain.

• https://attack.mitre.org/techniques/T1567/001/
• https://www.optimizationcore.com/security/github-exfiltration-indicators-threat-hunt-monitor-block/

Mitigations

• M1680 Limit access to code repositories

Detections

• D1510 Implement Intrusion Detection System and anti-malware
• D1590 Implement continuous monitoring and logging of the CI/CD process
• D1680 Monitor code repositories activity

Observed in incidents (9)

• actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
• codfish/semantic-release-action tag hijack (Miasma)
• GhostAction steals CI secrets, then autoruns a stealer from a fake font
• Nx s1ngularity (stolen npm token via Actions injection)
• testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
• Shai-Hulud first wave (@ctrl/tinycolor)
• Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
• TanStack Mini Shai-Hulud (CVE-2026-45321)
• Sha1-Hulud: The Second Coming

References

• https://attack.mitre.org/techniques/T1567/001/
• https://www.optimizationcore.com/security/github-exfiltration-indicators-threat-hunt-monitor-block/