IronWorm GitHub Actions Secrets Exfiltration via Workflow Modification

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious activity within GitHub Actions, identifying potential exfiltration or malicious automation by correlating signals such as masquerading actors (e.g., bots like dependabot), specific IronWorm-associated commit message patterns, usage of secrets-related JSON expressions in logs, and the use of innocuous file names for artifact uploads.