GCVE-110-OSM-2026-1051

Threat actors compromised the GitHub build process for aquasecurity/trivy and pushed a malicious update which installs an infostealer malware. Separately, this repository was also targeted in a September 2026 campaign that planted a shell command injection payload in a GitHub issue comment. When a CI workflow handles that text unsafely, the payload runs inside the job and sends its environment variables, which can include repository tokens, cloud credentials and deployment secrets, to an attacker-controlled server. A workflow in this repository was not shown to execute it, and the repository's own source code was not shown to be modified by this attack. Malicious tag included a link to a binary payload which we have not analyzed yet. Treat as CRITICAL until we know more. The threat actors created a lookalike domain: scan[.]aquasecurtiy[.]org. The build process pulled 4 malicious Golang files from this attacker-controlled domain. The malware is described by the threat actor as "TeamPCP Cloud stealer". The malware attempts to pull a secondary payload from can[.]aquasecurtiy[.]org and if that fails it polls hxxps://tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io for additional payloads. Credential Harvesting: The malware operated across two vectors — compromised GitHub Actions (trivy-action, setup-trivy) and a trojanized Trivy binary (v0.69.4). In CI/CD environments, it scraped Runner.Worker process memory via /proc/<pid>/mem looking for secrets, and swept the filesystem for SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes tokens, and cryptocurrency wallets across 50+ sensitive file paths. The trojanized binary performed similar theft on developer machines, also collecting environment variables and enumerating network interfaces. Exfiltration: Harvested credentials were encrypted using AES-256-CBC with RSA-4096 hybrid encryption, bundled into a tpcp.tar.gz archive, and transmitted to a typosquatted C2 domain (scan.aquasecurtiy[.]org). As a fallback, the GitHub Actions variant uploaded stolen data to a repo named tpcp-docs within the victim's own GitHub account — an unusual exfil technique that abused the runner's existing credentials. Persistence: When the trojanized binary detected it was running outside GitHub Actions (i.e., on a developer workstation), it dropped a Python script at ~/.config/systemd/user/sysmon.py and registered a systemd user unit for continuous execution. This dropper polled the C2 server for secondary payloads, establishing a persistent foothold beyond the initial credential theft. --- ## Additional attack: GitHub issue comment command injection (September 2026) Malicious payload found in: GitHub issue #11171, comment (hidden inside an HTML comment, so it does not show when the page is rendered; the issue title and body are clean) - Trigger: a GitHub Actions workflow that inserts attacker-controlled GitHub text into shell source. Bash performs command substitution on `$(...)` even inside double quotes, so the text runs as code. - Behavior: `env` collects the job's environment variables, `base64 | tr -d '\n'` encodes them, and `curl -s ... -d` POSTs them over plain HTTP (port 8443) to a collection server at `54[.]205[.]16[.]142`. A unique ID in the `/c/` path identifies the target. - Posted 2026-09-01 at 11:41 UTC, during the first of two waves of the same campaign. The issue was closed within seconds and a bot replied. Execution in this repository's workflows is not confirmed. - This is unrelated to the build compromise described above.