IronWorm GitHub Actions Workflow Tampering and Backdated Git Commit Exfil

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.