Executive Summary
In late 2025 and early 2026, threat actors such as TeamPCP ramped up supply chain attacks targeting CI/CD pipelines, specifically exploiting GitHub Actions through compromised components like 'trivy-action'. These campaigns—including Megalodon, Shai-Hulud, and Miasma—focus on the CI runner, which serves as the execution environment where secrets are decrypted and held in memory.
The technical tradecraft involves injecting malicious scripts into GitHub Action entry points to harvest credentials from the Runner.Worker process memory or persistent filesystems on self-hosted runners. These stolen secrets are then exfiltrated via HTTP or secondary GitHub repositories, feeding a 'Developer Credential Economy' that facilitates lateral movement into cloud infrastructure and production environments. Defenders must pivot toward runtime monitoring of ephemeral and self-hosted runners to close the visibility gap in the software supply chain.