Select a theme from the list.
Insights

From our experts

Latest
Microsoft Pushes Data-Loss Prevention Into the Path of Shadow AIDormant GitHub Actions Reawakened With Their Malicious Payloads IntactKiteworks Calls for Emergency Shutdown as Authorities Warn of Imminent AttacksUnpatched OnePlus Chain Gives Permissionless Android Apps Root ControlMacSync Turns Public iCloud Calendars Into a Hidden Malware Delivery ChannelStorm-2570 Changes Ransomware Brands but Keeps the Same Attack PlaybookExploited F5 OAuth Flaw Opens a Direct Route Into Access InfrastructureAI Attack Crews Turn Online Stores Into Industrial Card-Skimming TargetsMicrosoft Builds an Agentic Command Center for the Modern SOCOT Segmentation Study Finds Critical Devices Sharing Networks With Everyday ITBifrost Gateway Flaw Opens AI Infrastructure to Unauthenticated Command ExecutionTrustSink Turns a Rogue MFA Provider Into a Silent Password CollectorMicrosoft Pushes Data-Loss Prevention Into the Path of Shadow AIDormant GitHub Actions Reawakened With Their Malicious Payloads IntactKiteworks Calls for Emergency Shutdown as Authorities Warn of Imminent AttacksUnpatched OnePlus Chain Gives Permissionless Android Apps Root ControlMacSync Turns Public iCloud Calendars Into a Hidden Malware Delivery ChannelStorm-2570 Changes Ransomware Brands but Keeps the Same Attack PlaybookExploited F5 OAuth Flaw Opens a Direct Route Into Access InfrastructureAI Attack Crews Turn Online Stores Into Industrial Card-Skimming TargetsMicrosoft Builds an Agentic Command Center for the Modern SOCOT Segmentation Study Finds Critical Devices Sharing Networks With Everyday ITBifrost Gateway Flaw Opens AI Infrastructure to Unauthenticated Command ExecutionTrustSink Turns a Rogue MFA Provider Into a Silent Password Collector
Security Insight

Dormant GitHub Actions Reawakened With Their Malicious Payloads Intact

Source
Dormant GitHub Actions Reawakened With Their Malicious Payloads Intact
Photo by Sora Shimazaki on Pexels

Two previously compromised GitHub Actions resumed executing malware when their repositories unexpectedly became available again. Malicious release tags had never been removed, allowing existing workflows to download the payload without attackers publishing new code or changing victim configurations.

News Date: 2026-09-25

Two GitHub Actions associated with the Mini Shai-Hulud supply chain campaign began distributing malware again after their repositories were restored without first removing compromised release tags. GitHub subsequently disabled the repositories for a second time, but workflows referencing the affected versions may already have executed the malicious code.

The affected components were actions-cool/issues-helper and actions-cool/maintain-one-comment. They had originally been compromised on May 18, 2026, when attackers modified them to harvest credentials and secrets from CI/CD environments and send the information to external infrastructure.

A Supply Chain Threat Without New Malware

The repositories reportedly became accessible again on September 16. Because their release tags still pointed to the malicious content, projects using version-based references automatically resumed downloading and running the payload during scheduled jobs or events such as issue and pull-request creation.

This incident is significant because the attackers did not need to regain an account, publish a new release or interact with affected projects. Restoring access to the unchanged repositories was enough to reactivate the existing compromise.

Mutable version tags are convenient, but they introduce a dependency on the continuing integrity of an upstream repository. A tag such as v2 can be moved or can continue pointing to altered content, while a full commit SHA identifies one specific revision.

Recommended Response

  • Search all workflows for references to the two affected actions.
  • Treat actions-cool/[email protected] and other tag-based references as potentially compromised.
  • Remove the actions or pin replacements to verified, clean commit SHAs.
  • Rotate repository secrets, deployment credentials and tokens available to affected workflows.
  • Inspect workflow history for successful runs after September 16, particularly following earlier setup failures.
  • Review repositories and downstream systems for unexpected commits or deployments.

In my view, the incident exposes an important weakness in conventional supply chain response. Disabling a malicious repository contains immediate distribution, but it does not constitute remediation if hostile commits and tags remain intact. Restoring access without validating the repository can effectively restore the attack as well.

Development teams should combine SHA pinning with automated dependency inventories and secret minimization. Workflows should receive only the permissions and credentials required for each job, limiting the damage if a third-party action becomes hostile.

Talk to our team →

Latest

Microsoft Pushes Data-Loss Prevention Into the Path of Shadow AISep 26, 2026Dormant GitHub Actions Reawakened With Their Malicious Payloads IntactSep 26, 2026Kiteworks Calls for Emergency Shutdown as Authorities Warn of Imminent AttacksSep 26, 2026Unpatched OnePlus Chain Gives Permissionless Android Apps Root ControlSep 25, 2026MacSync Turns Public iCloud Calendars Into a Hidden Malware Delivery ChannelSep 25, 2026Storm-2570 Changes Ransomware Brands but Keeps the Same Attack PlaybookSep 25, 2026

Most read

1Sophos Turns Its Own Network Into a Proving Ground for Safer Enterprise AI2Sophos Fusion Recasts the Security Platform as an AI-Driven Defense System3Microsoft Makes Passkeys the Entra ID Default and Sets a Deadline for Native SMS Authentication4Global CMS Exploitation Wave Plants Webshells on Business Websites5Laser Attack Exposes an Unpatchable Weakness in Tangem Crypto Wallet Cards6Critical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade Path