--- title: "How threat actors are using self-hosted GitHub Actions runners as backdoors" url: https://daily.dev/posts/how-threat-actors-are-using-self-hosted-github-actions-runners-as-backdoors-1mhvpyhct source_url: https://webflow.sysdig.com/blog/how-threat-actors-are-using-self-hosted-github-actions-runners-as-backdoors type: article source: "Sysdig Blog" published: 2026-05-31T07:43:55.200Z updated: 2026-05-31T08:59:56.447Z tags: ["security", "cicd", "github-actions"] reading_time: 13 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How threat actors are using self-hosted GitHub Actions runners as backdoors **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 13 min read · 0 upvotes · 0 comments ## Summary Self-hosted GitHub Actions runners can be weaponized as persistent backdoors by attackers. The Shai-Hulud worm (November 2025) demonstrates this at scale: after compromising developer machines via trojanized npm packages, it creates a GitHub repo, registers a rogue runner, and plants an intentionally vulnerable workflow that allows command injection via GitHub Discussions. Key techniques include setting RUNNER_TRACKING_ID=0 to bypass process cleanup, running as root via RUNNER_ALLOW_RUNASROOT=1, and using nohup for persistence. All C2 traffic flows through github.com, bypassing traditional network defenses. Detection strategies include monitoring for the RUNNER_TRACKING_ID=0 env variable (a Falco rule is provided), auditing runner registrations via GitHub API, and watching for runners in hidden directories. Mitigations include never using self-hosted runners with public repos, using ephemeral runners, and restricting runner network access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Is GitHub Actions Putting Your Software at Risk?](https://daily.dev/posts/is-github-actions-putting-your-software-at-risk--a2b2a1jji) · Atomic Spin · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/how-threat-actors-are-using-self-hosted-github-actions-runners-as-backdoors-1mhvpyhct)