# CI/CD Runner Memory-Dump Credential Theft (CVE-2025-8217 technique): Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners

> CVE-2025-8217 (AWS-2025-016) let a malicious pull request run in AWS CodeBuild and dump build-environment memory to steal source-repository access tokens; a threat actor used it against AWS Toolkit for Visual Studio Code and AWS SDK for .NET. The same /proc memory-read technique was used in the tj-actions/changed-files compromise and in the Team PCP campaign, and StepSecurity now offers runtime monitoring (Harden-Runner) for CodeBuild-hosted GitHub Actions runners.

- **Published:** 2026-10-23T10:47:18Z
- **Last reviewed:** 2026-10-23T10:47:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4258
- **ID:** TL-2026-4258
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8217, CVE-2025-30066

## Description

The hunt source is a StepSecurity vendor post (2026-09-01) announcing Harden-Runner support for AWS CodeBuild-hosted GitHub Actions runners. It qualifies as threat intelligence through the attack pattern it cites: theft of CI/CD credentials by reading the memory of the build/runner process.

CVE-2025-8217 (AWS bulletin AWS-2025-016, 2025-07-25): security researchers from the Institute of Information Engineering, Chinese Academy of Sciences, reported that a threat actor could submit a pull request that, when built automatically by CodeBuild, would extract the source-repository access token (GitHub, Bitbucket or GitLab) through a memory dump of the build environment. If the token had write permission, the actor could commit malicious code. AWS stated that during its investigation it found a threat actor had used this technique to extract the access token for the AWS Toolkit for Visual Studio Code and AWS SDK for .NET repositories. AWS recommended disabling or filtering PR webhook builds, restricting PR builds to trusted users, rotating write-capable tokens, and considering GitHub Actions self-hosted runners. The AWS bulletin gives no CVSS score, no CWE and no IOCs.

Related technique reuse: in the tj-actions/changed-files compromise (CVE-2025-30066, March 2025) a malicious commit (0e58ed8671d6b60d0890c21b07f8835ace038e67), pointed to by retroactively rewritten version tags, ran a base64-decoded loader that downloaded a Python script (memdump.py) from a GitHub gist. The script located the Runner.Worker process, parsed /proc/<pid>/maps, read readable regions of /proc/<pid>/mem, regex-matched secrets, and wrote them (double-base64 encoded) to the public workflow log. StepSecurity's analysis of the CodeBuild incident describes the same /proc cmdline/maps/mem approach. Wiz Research's 'CodeBreach' disclosure (public 2026-01-15) showed a second route into CodeBuild: unanchored regex in webhook ACTOR_ACCOUNT_ID filters let an attacker register a GitHub ID that contained a trusted maintainer's ID as a substring, trigger a build, and dump the memory of a build-environment process that an earlier memory-dump mitigation had overlooked. This led to credential theft for the aws-sdk-js-automation account and potential admin takeover of aws/aws-sdk-js-v3. AWS anchored the filters within 48 hours of the 2025-08-25 report, revoked tokens, protected that process from memory dumping, and added a Pull Request Comment Approval gate.

Per StepSecurity's summary of CloudSEK research, the Team PCP campaign (2026-03-19 to 2026-03-24) exfiltrated 78,330 secrets from 2,186 organizations by compromising trusted components (Trivy GitHub Action, Checkmarx KICS Action, telnyx PyPI package, LiteLLM, Axios npm package, a self-spreading npm worm called ChainDrop) and harvesting credentials from CI/CD runner memory, with exfiltration to typosquatted C2 domains such as scan.aquasecurtiy.org. Stolen credentials included 999 JWTs, 480 private-key blocks, 320 AWS keys, 308 GitLab PATs, 183 GitHub PATs and 157 OpenAI keys. The Team PCP figures are second-hand via StepSecurity and were not checked against CloudSEK's original report.

The hunt source describes Harden-Runner v2.20.1+ for CodeBuild EC2-hosted runners and v2.21.0+ for Linux containers on EC2 and custom images. Requirements are EC2 compute (not Lambda), a kernel-6 host (Amazon Linux 2023), and privileged mode. The workflow label format is runs-on: codebuild-<project-name>-${{ github.run_id }}-${{ github.run_attempt }}. No actor attribution is stated for the CVE-2025-8217 exploitation. A BeaconBeagle config search for scan.aquasecurtiy.org returned no matches.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.006 Python
- T1003.007 Proc Filesystem
- T1528 Steal Application Access Token
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1583.001 Domains

## Sources

- [Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners (StepSecurity)](https://www.stepsecurity.io/blog/runtime-security-for-aws-codebuild-hosted-github-actions-runners)
- [AWS Security Bulletin AWS-2025-016 (CVE-2025-8217)](https://aws.amazon.com/security/security-bulletins/aws-2025-016)
- [Lessons from AWS CodeBuild's Memory-Dump Incident (CVE-2025-8217) (StepSecurity)](https://www.stepsecurity.io/blog/lessons-from-aws-codebuilds-memory-dump-incident-cve-2025-8217)
- [CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild (Wiz Research)](https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild)
- [Harden-Runner Detection: tj-actions/changed-files Action is Compromised (StepSecurity)](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
- [Detecting and Mitigating the tj-actions/changed-files Supply Chain Attack (CVE-2025-30066) (Sysdig)](https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/)
- [Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. (StepSecurity)](https://www.stepsecurity.io/blog/teampcp-supply-chain-attack-cicd-secrets-cloudsek-disclosure)
- [AWS Console Supply Chain Flaw Could Have Enabled GitHub Repo Hijacks (eSecurity Planet)](https://www.esecurityplanet.com/threats/aws-console-supply-chain-flaw-could-have-enabled-github-repo-hijacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4258