GCVE-110-OSM-2025-1081

Repository contains an abusive GitHub Actions workflow that establishes unauthorized remote desktop access to a GitHub-hosted Windows runner. It changes operating-system security settings and a local account password before exposing RDP through a public tunneling service. Malicious payload found in: .github/workflows/main.yml The workflow runs on push or manual dispatch using windows-latest. It downloads the official ngrok Windows archive from https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-amd64.zip, extracts it, and authenticates using the NGROK_AUTH_TOKEN repository secret. It enables Terminal Services, enables the Remote Desktop firewall group, configures RDP network-level authentication, changes runneradmin to the hard-coded password P@ssw0rd!, and starts an ngrok TCP tunnel to local port 3389. The assigned public tunnel address is not statically available. The ngrok service is legitimate infrastructure abused by this workflow and is therefore not included as a verified malicious IOC.