Poisoned Pipeline / Techniques / T0199
Secret leak
SCM Posture CI/CD Posture
- In the realm of software supply chains, attackers covet secrets. Gaining access to customer secrets enables attackers to advance to the next stage of their malicious activities.
Where this idea came from
Taken from a public incident, vendor advisory, or first-party write-up cited below.
- https://sec.okta.com/articles/2022/12/okta-code-repositories
- https://circleci.com/blog/jan-4-2023-incident-report/#what-happened
Mitigations
- M1661 Revoke user permissions
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1860 Configure audit logs for SCM
Observed in incidents (10)
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- Team PCP CI/CD secrets campaign
- TraderTraitor interview repos point Terraform at a lookalike provider registry
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- tj-actions/changed-files GitHub Action
- Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
- Railway build-infrastructure access decrypted a subset of customer environment variables
- CircleCI December 2022 / January 2023 incident
- Stolen ConnectWise Cloud Backup application identities signed in to customer Microsoft 365 tenants