Hackers have been using GitHub cloud infrastructure to covertly mine multiple cryptocurrencies, The Record reported.
The attacks were first spotted by a French software engineer in November, a fact the development platform’s team confirmed to The Record last week via email.
The attack abused a GitHub feature called GitHub Actions, which allows users to automatically execute tasks and workflows triggered by a certain event happens inside their repositories. To launch crypto mining software, the attackers would fork an existing repository, add malicious GitHub Actions element to the original code, and then file a Pull Request with the original repository to merge the code back into the original, The Record wrote.
The original project owner didn’t have to approve the malicious Pull Request because right after it was filed GitHub’s systems would read the attacker’s code and launch a virtual machine, which would download and run crypto-mining software, as Dutch security engineer Justin Perdok told The Record. He added that “attackers spin up to 100 crypto-miners via one attack alone, creating huge computational loads for GitHub’s infrastructure.”
The mining software, according to screenshots published by The Record, included SRBMiner, a software for mining multiple cryptocurrencies using easy-to-buy consumer hardware, namely GPUs and CPUs.
In any case, it looks like the attackers didn’t look to damage the repositories in any way, only to get free coins using GitHub servers, the report reads.