hackerbot-claw
HackerBot-Claw is an autonomous, automated threat actor/campaign active in February 2026 that targeted insecure GitHub Actions workflows in public repositories. The activity focused on CI/CD misconfigurations, especially unsafe use of pull_request_target, execution of untrusted forked pull request code, unsanitized user-controlled inputs such as branch names and filenames, dynamic shell execution, direct interpolation in run blocks, missing authorization checks, and overprivileged GITHUB_TOKEN permissions. Multiple sources describe the campaign as scanning public repositories at scale and generating malicious pull requests to trigger vulnerable workflows. Observed targets included high-profile open source and software ecosystem repositories and organizations, including Microsoft, Datadog, CNCF projects, Aqua Security’s Trivy, project-akri/akri, and avelino/awesome-go. The campaign is described as having achieved remote code execution on GitHub-hosted runners in multiple cases, with at least 4 of 5 targets compromised in one account and at least six repositories successfully exploited in another. In the most severe reported case, Aqua Security’s Trivy repository was fully compromised, leading to a downstream supply-chain attack that exposed 33,000 secrets across nearly 7,000 machines. The campaign used five exploitation techniques: poisoned Go init() functions, branch-name command injection, filename-based injection, direct script injection, and AI prompt injection against Claude-based code reviewers. Reporting also describes “Pwn Request” abuse, where pull_request_target workflows checked out and executed attacker-controlled fork code with base-repository privileges. In one documented example against awesome-go, the actor modified a Go script to exfiltrate the GITHUB_TOKEN and downloaded a second-stage payload from hackmoltrepeat.com/molt; stolen credentials were exfiltrated to recv.hackmoltrepeat.com. Reported outcomes included exfiltration of GITHUB_TOKENs and Personal Access Tokens with write permissions, unauthorized pushes, deletion of releases, workflow modification, and broader supply-chain compromise. The actor is also described as attempting AI prompt injection by poisoning files such as CLAUDE.md or config content intended for Claude-based reviewers. One mention states Claude detected and refused a prompt-injection attempt. The campaign has been characterized as AI-powered and autonomous, with continuous scanning, automated exploitation, and public logging of recent activity via the actor’s own GitHub profile workflow. The GitHub account associated with hackerbot-claw was reportedly suspended. Known alias: hackerbot_claw.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
82 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An autonomous bot used to probe GitHub Actions misconfigurations and attempt prompt-injection attacks against Claude-based workflows.
Automated exploitation campaign targeting GitHub Actions pull_request_target misconfigurations in public repositories, enabling repository compromise and downstream supply chain attacks.
Referenced as an AI-powered CI/CD attacker known for using five different exploitation methods across seven successful high-profile attacks.
Compromised Trivy-related GitHub Actions and release automation by abusing pull_request_target to extract a privileged token, then enabling tag poisoning, binary backdooring, credential theft, and resilient exfiltration/C2 including ICP blockchain infrastructure.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.