Threat reportSupply ChainTL-2026-4258
CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217 technique): Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217 (TL-2026-4258), also tracked as CodeBreach, is a high-severity supply-chain compromise, first published 2026-10-23. It has no confirmed attribution, affects Amazon Web Services AWS CodeBuild (PR webhook builds), references 2 CVEs (CVE-2025-8217, CVE-2025-30066), maps to 10 MITRE ATT&CK techniques (T1003.007, T1005, T1027), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4258
- Threat ID
- TL-2026-4258
- Also known as
- CodeBreach, AWS-2025-016, Team PCP CI/CD secrets campaign
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-services, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
Malware and tooling: ChainDrop
How CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217 works
CVE-2025-8217 (AWS-2025-016) let a malicious pull request run in AWS CodeBuild and dump build-environment memory to steal source-repository access tokens; a threat actor used it against AWS Toolkit for Visual Studio Code and AWS SDK for .NET. The same /proc memory-read technique was used in the tj-actions/changed-files compromise and in the Team PCP campaign, and StepSecurity now offers runtime monitoring (Harden-Runner) for CodeBuild-hosted GitHub Actions runners.
The hunt source is a StepSecurity vendor post (2026-09-01) announcing Harden-Runner support for AWS CodeBuild-hosted GitHub Actions runners. It qualifies as threat intelligence through the attack pattern it cites: theft of CI/CD credentials by reading the memory of the build/runner process.
CVE-2025-8217 (AWS bulletin AWS-2025-016, 2025-07-25): security researchers from the Institute of Information Engineering, Chinese Academy of Sciences, reported that a threat actor could submit a pull request that, when built automatically by CodeBuild, would extract the source-repository access token (GitHub, Bitbucket or GitLab) through a memory dump of the build environment. If the token had write permission, the actor could commit malicious code. AWS stated that during its investigation it found a threat actor had used this technique to extract the access token for the AWS Toolkit for Visual Studio Code and AWS SDK for .NET repositories. AWS recommended disabling or filtering PR webhook builds, restricting PR builds to trusted users, rotating write-capable tokens, and considering GitHub Actions self-hosted runners. The AWS bulletin gives no CVSS score, no CWE and no IOCs.
Related technique reuse: in the tj-actions/changed-files compromise (CVE-2025-30066, March 2025) a malicious commit (0e58ed8671d6b60d0890c21b07f8835ace038e67), pointed to by retroactively rewritten version tags, ran a base64-decoded loader that downloaded a Python script (memdump.py) from a GitHub gist. The script located the Runner.Worker process, parsed /proc/<pid>/maps, read readable regions of /proc/<pid>/mem, regex-matched secrets, and wrote them (double-base64 encoded) to the public workflow log. StepSecurity's analysis of the CodeBuild incident describes the same /proc cmdline/maps/mem approach. Wiz Research's 'CodeBreach' disclosure (public 2026-01-15) showed a second route into CodeBuild: unanchored regex in webhook ACTOR_ACCOUNT_ID filters let an attacker register a GitHub ID that contained a trusted maintainer's ID as a substring, trigger a build, and dump the memory of a build-environment process that an earlier memory-dump mitigation had overlooked. This led to credential theft for the aws-sdk-js-automation account and potential admin takeover of aws/aws-sdk-js-v3. AWS anchored the filters within 48 hours of the 2025-08-25 report, revoked tokens, protected that process from memory dumping, and added a Pull Request Comment Approval gate.
Per StepSecurity's summary of CloudSEK research, the Team PCP campaign (2026-03-19 to 2026-03-24) exfiltrated 78,330 secrets from 2,186 organizations by compromising trusted components (Trivy GitHub Action, Checkmarx KICS Action, telnyx PyPI package, LiteLLM, Axios npm package, a self-spreading npm worm called ChainDrop) and harvesting credentials from CI/CD runner memory, with exfiltration to typosquatted C2 domains such as scan.aquasecurtiy.org. Stolen credentials included 999 JWTs, 480 private-key blocks, 320 AWS keys, 308 GitLab PATs, 183 GitHub PATs and 157 OpenAI keys. The Team PCP figures are second-hand via StepSecurity and were not checked against CloudSEK's original report.
The hunt source describes Harden-Runner v2.20.1+ for CodeBuild EC2-hosted runners and v2.21.0+ for Linux containers on EC2 and custom images. Requirements are EC2 compute (not Lambda), a kernel-6 host (Amazon Linux 2023), and privileged mode. The workflow label format is runs-on: codebuild-<project-name>-${{ github.run_id }}-${{ github.run_attempt }}. No actor attribution is stated for the CVE-2025-8217 exploitation. A BeaconBeagle config search for scan.aquasecurtiy.org returned no matches.
MITRE ATT&CK techniques used in TL-2026-4258
Credential Access
T1003.007 Proc Filesystem; T1528 Steal Application Access Token
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Execution
Initial Access
T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
- Amazon Web Services — AWS CodeBuild (PR webhook builds)
Vulnerable versions: Pre-mitigation service behavior (before AWS fixes of July-August 2025)
Fixed in: Service-side mitigation by AWS; customer token rotation advised - tj-actions — tj-actions/changed-files GitHub Action
Vulnerable versions: 0 through 45.0.7 (tags retroactively repointed)
Fixed in: 46.0.1 - StepSecurity — Harden-Runner (defensive control for CodeBuild-hosted runners)
Fixed in: 2.20.1 (CodeBuild EC2); 2.21.0 (Linux containers on EC2, custom images)
Remediation for CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
Patches
- AWS addressed CVE-2025-8217 service-side (AWS-2025-016); no customer patch is required, but customer-side token rotation and webhook hardening are advised
- Update tj-actions/changed-files to v46.0.1 or later (or replace it)
Immediate actions
- Rotate any source-provider tokens with write permission used by CodeBuild projects that built pull requests automatically
- Disable CodeBuild webhook builds for pull requests, or filter PR events, until triggers are restricted to trusted users
- Rotate secrets exposed to any workflow that used tj-actions/changed-files, reviewdog actions, Trivy Action or KICS Action during the compromise windows
- Block and hunt for outbound connections to scan.aquasecurtiy.org
Workarounds
- Anchor webhook filter regexes with ^ and $ (ACTOR_ACCOUNT_ID filters)
- Use GitHub Actions self-hosted runners instead of PR-triggered CodeBuild builds
Longer-term hardening
- Deploy runtime monitoring on CI runners (for example Harden-Runner on CodeBuild EC2-hosted runners, v2.20.1+; v2.21.0+ for Linux containers) to detect /proc memory reads and anomalous egress
- Use read-only or fine-grained tokens with minimal scope and a separate automation account per CodeBuild project
- Enable the CodeBuild Pull Request Comment Approval gate and require manual approval for untrusted PR builds
- Pin third-party GitHub Actions to full commit SHAs
CVEs associated with CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
Timeline of CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
- tj-actions/changed-files compromised; version tags repointed to malicious commit 0e58ed86... which loads memdump.py to read Runner.Worker memory (StepSecurity detected via Harden-Runner; Sysdig reports exposure from 2025-03-12 to 2025-03-15)
- tj-actions/changed-files repository removed then restored after the malicious commit was cleaned up; CVE-2025-30066 assigned
- AWS publishes bulletin AWS-2025-016 (CVE-2025-8217): CodeBuild PR builds could leak the source-repository token via memory dump; a threat actor already used it against AWS Toolkit for VS Code and AWS SDK for .NET repositories
- Wiz Research reports CodeBreach (unanchored webhook ACTOR_ACCOUNT_ID regex plus an overlooked memory-dump target) to AWS
- AWS anchors the vulnerable regex filters, revokes exposed tokens and protects the remaining build process from memory dumping; further hardening follows in September 2025
- Wiz publicly discloses CodeBreach; AWS adds the Pull Request Comment Approval build gate and reports no unauthorized access found in CloudTrail audit
- Team PCP campaign begins (Trivy Action, Checkmarx KICS Action, telnyx, LiteLLM, Axios, ChainDrop worm); runner-memory secret theft with typosquatted C2
- Five-day Team PCP window ends: per CloudSEK, 78,330 secrets stolen from 2,186 organizations
- StepSecurity publishes Harden-Runner support for AWS CodeBuild-hosted GitHub Actions runners (v2.20.1+; v2.21.0 adds Linux containers on EC2)
Sources cited for CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217
- Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners (StepSecurity)
- AWS Security Bulletin AWS-2025-016 (CVE-2025-8217)
- Lessons from AWS CodeBuild's Memory-Dump Incident (CVE-2025-8217) (StepSecurity)
- CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild (Wiz Research)
- Harden-Runner Detection: tj-actions/changed-files Action is Compromised (StepSecurity)
- Detecting and Mitigating the tj-actions/changed-files Supply Chain Attack (CVE-2025-30066) (Sysdig)
- Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. (StepSecurity)
- AWS Console Supply Chain Flaw Could Have Enabled GitHub Repo Hijacks (eSecurity Planet)
Detection coverage for TL-2026-4258
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4258 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.