HOW THREAT ACTORS ARE USING SELF-HOSTED GITHUB ACTIONS RUNNERS AS BACKDOORS

Summary from the TLDR InfoSec newsletter

The Shai-Hulud worm demonstrated how attackers weaponize self-hosted GitHub Actions runners as persistent backdoors by installing rogue runners on compromised machines and using GitHub Discussions as a command-and-control channel via intentionally vulnerable workflows with command injection. The technique exploited the RUNNER_TRACKING_ID=0 environment variable to bypass process cleanup and achieve persistence, while all traffic flowed to github.com, evading traditional network defenses. Security teams should audit runner inventories for unauthorized registrations, implement ephemeral runners, restrict self-hosted runners to private repositories only, and deploy runtime detection for persistence techniques.