Researcher says GitHub Actions has been actively abused to plant and run cryptominers on GitHub's server infrastructure since November; GitHub is investigating
Code-hosting service GitHub is actively investigating a series of attacks against its cloud infrastructure that allowed cybercriminals …
Context & Ripple Effects
This is the earliest well-documented case in a string of reports about attackers turning GitHub from a code host into free attacker infrastructure: since November, someone has been abusing GitHub Actions' free compute to plant and run cryptominers directly on GitHub's servers, and GitHub is now investigating. What makes the story durable is how the pattern repeated — Trend Micro researchers later showed threat actors could abuse GitHub Codespaces' port forwarding to host malware, and Recorded Future catalogued routine criminal and APT use of GitHub services for malware delivery.
First-order effects
- GitHub is spending its own compute budget on someone else's cryptocurrency mining while its security team investigates which repositories and workflow triggers were used.
- Developers relying on Actions' free tier are the immediate exposure: any repository that can trigger workflows becomes a potential entry point for planting miner workloads.
Second-order effects
- GitHub faces pressure to tighten Actions quotas, runner isolation, and abuse detection on its free tier — the same hardening cycle later seen around Codespaces and repository-trust features.
- Security teams treating GitHub purely as a code host must reclassify its CI/compute services as attack surface, changing how they vet third-party repositories and pull requests.
Third-order effects
- The mining abuse is the template for what followed: cloned-repo confusion campaigns, automated-commit supply chain attacks like Megalodon's infection of more than 5,500 repositories, and broader criminal reliance on GitHub infrastructure — pointing toward platforms where trust in automation itself becomes the primary security control.
The trend: Hosted developer platforms are being converted into free attacker compute and distribution infrastructure, forcing providers like GitHub to treat their automation layers as a security perimeter rather than a convenience feature.