
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
The imposter commit, per the cybersecurity company, contains code that, upon being executed within a GitHub Actions runner, performs a series of actions -
- Downloads the Bun JavaScript runtime to the runner.
- Reads memory from the Runner.Worker process to extract credentials.
- Makes an outbound HTTPS call to an attacker-controlled domain ("t.m-kosche[.]com") to transmit the stolen data.