Hackers Mined Crypto on GitHub's Servers: Report
The activity was first noticed in November, according to the report.
![GitHub logo on a door at the company office in San Francisco](https://www.coindesk.com/resizer/KbYNpPSrHQBe_33DLu9rYa72jo4=/567x378/filters:quality(80):format(jpg)/cloudfront-us-east-1.images.arcpublishing.com/coindesk/SZMRWFID7VBHRHVCIZYTATCGTY.jpg)
The attack abused a GitHub feature called GitHub Actions, which allows users to automatically execute tasks and workflows triggered by a certain event happens inside their repositories. To launch crypto mining software, the attackers would fork an existing repository, add malicious GitHub Actions element to the original code, and then file a Pull Request with the original repository to merge the code back into the original, The Record wrote.
The original project owner didn't have to approve the malicious Pull Request because right after it was filed GitHub’s systems would read the attacker’s code and launch a virtual machine, which would download and run crypto-mining software, as Dutch security engineer Justin Perdok told The Record. He added that "attackers spin up to 100 crypto-miners via one attack alone, creating huge computational loads for GitHub’s infrastructure."
The mining software, according to screenshots published by The Record, included SRBMiner, a software for mining multiple cryptocurrencies using easy-to-buy consumer hardware, namely GPUs and CPUs.
In any case, it looks like the attackers didn't look to damage the repositories in any way, only to get free coins using GitHub servers, the report reads.