IronWorm GitHub Actions Workflow Overwrite for Secret Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects suspicious modifications to GitHub Actions workflows, such as unauthorized file overwrites, commits by bot impersonation identities (e.g., dependabot, renovate), or the upload of sensitive artifacts like 'format-results.txt'. These activities are indicative of IronWorm-style attacks targeting CI/CD pipelines to exfiltrate secrets via build artifacts.