orca[.]securityDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
CI/CD pipeline abuse: the problem no one is watching“hxxps://orca[.]security/resources/blog/pull-request-nightmare-github-actions-rce/”
Indicators reported together
named in the same reports- cicd[.]actorin 1 report
- hxxps://github[.]com/elastic/cicd-abuse-detectorin 1 report
- hxxps://github[.]com/synacktiv/nord-streamin 1 report
- hxxps://github[.]com/AdnaneKhan/Gato-Xin 1 report
- hxxps://blog.gitguardian[.]com/ghostaction-campaign-3-325-secrets-stolenin 1 report
- blog.gitguardian[.]comin 1 report
- hxxps://www.reversinglabs[.]com/blog/shai-hulud-worm-npmin 1 report
- hxxps://orca[.]security/resources/blog/pull-request-nightmare-github-actions-rce/in 1 report
- hxxps://orca[.]security/resources/blog/hackerbot-claw-github-actions-attack/in 1 report
- hxxps://www.stepsecurity[.]io/blog/hackerbot-claw-github-actions-exploitationin 1 report
- www.stepsecurity[.]ioin 1 report
- hxxps://www.legitsecurity[.]com/blog/github-privilege-escalation-vulnerability-0in 1 report
- www.legitsecurity[.]comin 1 report
- hxxps://www.abstract[.]security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vectorin 1 report
- www.abstract[.]securityin 1 report
- hxxps://about.codecov[.]io/apr-2021-post-mortem/in 1 report
- about.codecov[.]ioin 1 report
- hxxps://kl4r10n[.]tech/blog/when-git-history-liesin 1 report
- kl4r10n[.]techin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-30066
Thanks — we review every report.