Aqua Security has discovered a wave of cybersecurity attacks that abuse automated build processes to hijack resources from software development environments such as Docker Hub, GitHub, Travis CI and Circle CI to mine cryptocurrencies.
Assaf Morag, lead data analyst at Aqua Security, says some of the attacks were traced to 11 GitHub accounts that were used to create 51 GitHub projects that were masquerading as popular software projects including nginx, okular, openssh, openvpn, seahorse, nautilus and zookeeper. At the same time, researchers over the course of a few hours also discovered 56 Docker Hub accounts also using the names of popular software. During the build process, these container images proceeded to download a cryptominer from a single GitHub repository.
