CI runner secret encoding via printf/base64 chaining (evasion prior to exfiltration)

Ethan Andrews@eandrews

•updated Aug 17, 2026•4•1•7

Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.