Skip to content

HackerBot Claw GitHub Actions exploitation campaign

Tags

Summary

Between February 21 and March 2, 2026, the GitHub account HackerBot Claw systematically targeted public repositories for GitHub Actions exploitation. Public reporting says the bot achieved remote code execution in multiple targets and exfiltrated a write-capable GitHub token from one of the most popular repositories on GitHub.

Timeline

  • Feb 21, 2026: campaign window begins.
  • Over the following 10 days: the bot opens multiple PRs across major repos and iterates on exploitation techniques.
  • By March 2, 2026: the campaign has successfully executed in multiple targets and obtained a write-token exfiltration result in at least one case.

Evidence

  • Public reporting names at least 7 targets spanning Microsoft, DataDog, CNCF, and major open-source projects.
  • The bot is described as an autonomous security research agent powered by Claude.
  • The attacker iterated across multiple PRs and exploit forms.
  • The campaign produced a token exfiltration event with GITHUB_TOKEN write permissions.

Core exploitation techniques

  1. Pwn Request / pull_request_target abuse
  2. Script injection via directly modified workflow helper scripts
  3. Branch name injection into shell-evaluated workflow metadata
  4. Filename injection via shell-expanded filenames
  5. Prompt injection against an AI code-review workflow

Why it matters

This campaign is notable because it shows that GitHub Actions abuse can be fully automated and diversified across many exploit primitives. It also demonstrates that AI-assisted review and automation layers can be targeted as part of the attack path.

TeamPCP relation

StepSecurity’s reporting links HackerBot Claw into the same supply-chain ecosystem as TeamPCP, whose follow-on activity includes Trivy compromise and CanisterWorm. On this wiki, TeamPCP is treated as the human/group actor; HackerBot Claw is the autonomous exploitation bot used in the GitHub Actions campaign.

Defender takeaways

  • Avoid pull_request_target with untrusted checkout
  • Never execute attacker-controlled branch names or filenames in shell contexts
  • Treat PR metadata as attacker-controlled input
  • Add egress monitoring in CI
  • Restrict AI-code-review workflows to the minimum viable permissions

References

  • StepSecurity
  • StepSecurity blog feed: https://www.stepsecurity.io/blog/rss.xml