Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

GitHub Action tag mutation → silent supply-chain hijack

Target pins an action by tag (uses: org/action@v3). Compromise the action repo and move the v3 tag to a malicious commit — every workflow using it pulls in the backdoor.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses unpinned GitHub Actions references (tags rather than 40-char commit SHAs). Attacker has gained maintainer access to a popular action repo via account takeover / abandoned dependency.

§ Steps

  1. 01
    Wait for downstream workflow runsInitial Access
    T1078— Valid Accounts
  2. 02
    Push malicious commitInitial Access
    T1078— Valid Accounts
  3. 03
    Exfil all secrets from runsCredential Access
    CI-SECRET-IN-LOG— Secret Echo to Build Log
  4. 04
    Maintainer account takeoverInitial Access
    SUP-PACKAGE-TAKEOVER— Package Maintainer Takeover
  5. 05
    Move v3 tag to malicious commitPersistence
    SUP-ACTION-TAG-MUTATION— GitHub Action Tag Mutation

§ References

§ Frequently asked

What is the "GitHub Action tag mutation → silent supply-chain hijack" attack path?
Target pins an action by tag (uses: org/action@v3). Compromise the action repo and move the v3 tag to a malicious commit — every workflow using it pulls in the backdoor. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Wait for downstream workflow runs (T1078) — a initial access primitive. Assumed environment: target uses unpinned GitHub Actions references (tags rather than 40-char commit SHAs).
What is the final impact of this kill-chain?
The final step lands on Move v3 tag to malicious commit (SUP-ACTION-TAG-MUTATION), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers