Loading threat actor…
glthub-actions is an unidentified threat actor known for abusing GitHub Actions and AI-assisted repository automation to compromise software publishing workflows. The actor was attributed with high confidence to a GitHub account using the name glthub-actions and was linked to a supply-chain intrusion affecting the Cline CLI package ecosystem in February 2026. The actor exploited a prompt-injection weakness in a Claude-powered GitHub issue triage workflow by placing a malicious payload in a GitHub issue title. This caused the automation to execute attacker-controlled package installation steps in CI. The intrusion chain included execution within GitHub Actions, cache poisoning to persist data across workflows, and exfiltration of publishing secrets when later workflows restored the poisoned cache. Stolen credentials were then used to publish an unauthorized npm release of the Cline CLI package. That release added a post-installation dependency installation step but did not alter the main CLI binary, and the activity has been assessed as consistent with a proof-of-concept or vulnerability-demonstration operation rather than a destructive malware campaign. The actor also conducted repeated testing activity through multiple GitHub issues and was linked to exploitation attempts against another repository using a separate GitHub Actions injection pattern. The observed behavior indicates strong capability in CI/CD exploitation, supply-chain compromise, secret theft, and abuse of automation pipelines. The available evidence supports characterization as an unknown actor engaged in vulnerability hunting and opportunistic exploitation of software development workflows. No high-confidence country attribution is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.