Coinbase was the target of GitHub Actions breaches

Researchers have found that Coinbase was the main target in a recent GitHub Actions supply chain attack , which affected hundreds of repositories.

See also: FBI: New crypto scam via fake job ads

According to new reports from Palo Alto Unit 42 and Wiz, the attack was carefully planned and began when malicious code was injected into the GitHub action reviewdog/action-setup@v1 . It’s unclear how the breach occurred, but the attackers modified the action to dump CI/CD secrets and credentials to the GitHub Actions logs.

As previously reported, the first stage of the breach involved subverting the GitHub Action reviewdog/action-setup@v1. It is unclear how the breach, but when a related GitHub Action, tj-actions/eslint-changed-files, triggered the action reviewdog, it resulted in its secrets being exposed in the workflow logs.

This allowed the attackers to steal a Personal Access Credential, which was then used to push a malicious commit to GitHub's tj-actions/changed-files action, which again exposes CI/CD secrets in workflow logs.

However, this initial commit targeted specific Coinbase projects and another user named “mmvojwip,” which is the attacker’s account.

See also: Indian man stole $37 million worth of crypto via fake Coinbase site

The power of the modified files was used by over 20,000 other projects, including coinbase/agent kit , a popular framework that allows AI agents to interact with blockchains.

According to Unit 42, Coinbase’s agentkit process executed the actions associated with the modified files, allowing the attackers to steal the tokens that granted them write privileges to the repository. However, Coinbase later informed Unit 42 that the attack was unsuccessful and did not affect any of their assets.

Unit 42 and Wiz’s report confirms that the campaign initially focused heavily on Coinbase and expanded to all projects using tj-actions/changed-files once their initial attempt failed. While 23,000 projects used the change-files action, only 218 repositories were ultimately affected by the breach.

See also: Crypto drainers exist on thousands of WordPress sites

GitHub Actions is an automation platform that allows users to create workflows to automate various tasks related to software development. These workflows can include processes such as build, tests, deployment, and other tasks related to continuous integration (CI) and continuous development (CD). GitHub Actions is a very powerful tool to automate and improve the productivity of your projects on GitHub!

Source: bleepingcomputer