{"id":1316,"date":"2026-05-23T07:22:16","date_gmt":"2026-05-23T00:22:16","guid":{"rendered":"https:\/\/vncybers.vn\/megalodon-github-actions-ci-cd-supply-chain\/"},"modified":"2026-06-01T03:09:30","modified_gmt":"2026-05-31T20:09:30","slug":"megalodon-github-actions-ci-cd-supply-chain","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/megalodon-github-actions-ci-cd-supply-chain\/","title":{"rendered":"Megalodon: Khi GitHub Actions tr\u1edf th\u00e0nh c\u1eeda h\u1eadu chu\u1ed7i cung \u1ee9ng"},"content":{"rendered":"

Megalodon<\/strong>, chi\u1ebfn d\u1ecbch \u0111\u01b0\u1ee3c SafeDep c\u00f4ng b\u1ed1 ng\u00e0y 22\/05\/2026, l\u00e0 l\u1eddi nh\u1eafc r\u1ea5t r\u00f5 r\u1eb1ng chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m kh\u00f4ng ch\u1ec9 b\u1ecb t\u1ea5n c\u00f4ng \u1edf package registry. Trong nhi\u1ec1u tr\u01b0\u1eddng h\u1ee3p, n\u01a1i nguy hi\u1ec3m h\u01a1n l\u1ea1i l\u00e0 h\u1ec7 th\u1ed1ng CI\/CD: ph\u1ea7n m\u00e1y t\u1ef1 \u0111\u1ed9ng build, test, k\u00fd, \u0111\u00f3ng g\u00f3i v\u00e0 tri\u1ec3n khai m\u00e3 ngu\u1ed3n.<\/p>\n\n\n\n

Theo t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News<\/a> v\u00e0 b\u00e1o c\u00e1o g\u1ed1c c\u1ee7a SafeDep<\/a>, Megalodon \u0111\u00e3 \u0111\u1ea9y 5.718 commit \u0111\u1ed9c h\u1ea1i v\u00e0o 5.561 repository GitHub trong kho\u1ea3ng s\u00e1u gi\u1edd ng\u00e0y 18\/05\/2026. \u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd: m\u00e3 \u0111\u1ed9c kh\u00f4ng c\u1ea7n s\u1eeda logic \u1ee9ng d\u1ee5ng. N\u00f3 ch\u00e8n workflow GitHub Actions \u0111\u1ec3 ch\u1ea1y ngay trong m\u00f4i tr\u01b0\u1eddng build, n\u01a1i th\u01b0\u1eddng n\u1eafm gi\u1eef token, kh\u00f3a cloud v\u00e0 b\u00ed m\u1eadt tri\u1ec3n khai.<\/p>\n\n\n\n

V\u00ec sao CI\/CD tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau ch\u00ednh?<\/h2>\n\n\n\n

Trong m\u00f4 h\u00ecnh ph\u00e1t tri\u1ec3n hi\u1ec7n \u0111\u1ea1i, CI\/CD l\u00e0 \u201cph\u00f2ng m\u00e1y\u201d c\u1ee7a s\u1ea3n ph\u1ea9m s\u1ed1. M\u1ed9t commit \u0111\u01b0\u1ee3c merge c\u00f3 th\u1ec3 k\u00edch ho\u1ea1t h\u00e0ng lo\u1ea1t t\u00e1c v\u1ee5: t\u1ea3i dependency, ch\u1ea1y test, build image, \u0111\u1ea9y artifact, deploy l\u00ean cloud, publish package ho\u1eb7c c\u1eadp nh\u1eadt h\u1ea1 t\u1ea7ng b\u1eb1ng Terraform. \u0110\u1ec3 l\u00e0m \u0111\u01b0\u1ee3c vi\u1ec7c \u0111\u00f3, runner th\u01b0\u1eddng \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n truy c\u1eadp v\u00e0o nhi\u1ec1u h\u1ec7 th\u1ed1ng nh\u1ea1y c\u1ea3m.<\/p>\n\n\n\n

\u0110\u00e2y ch\u00ednh l\u00e0 l\u00fd do attacker th\u00edch CI\/CD. Thay v\u00ec \u0111i t\u00ecm t\u1eebng m\u00e1y ch\u1ee7, ch\u00fang ch\u1ec9 c\u1ea7n khi\u1ebfn pipeline ch\u1ea1y payload trong \u0111\u00fang th\u1eddi \u0111i\u1ec3m c\u00f3 secret \u0111\u01b0\u1ee3c n\u1ea1p v\u00e0o m\u00f4i tr\u01b0\u1eddng. M\u1ed9t workflow t\u01b0\u1edfng nh\u01b0 v\u00f4 h\u1ea1i c\u00f3 th\u1ec3 \u0111\u1ecdc bi\u1ebfn m\u00f4i tr\u01b0\u1eddng, ki\u1ec3m tra file c\u1ea5u h\u00ecnh, g\u1ecdi metadata service c\u1ee7a cloud v\u00e0 g\u1eedi d\u1eef li\u1ec7u ra ngo\u00e0i tr\u01b0\u1edbc khi log b\u1ecb x\u00f3a ho\u1eb7c job ho\u00e0n t\u1ea5t.<\/p>\n\n\n\n

\"Minh
CI\/CD runner th\u01b0\u1eddng l\u00e0 n\u01a1i t\u1eadp trung token, kh\u00f3a cloud v\u00e0 quy\u1ec1n tri\u1ec3n khai. N\u1ebfu workflow b\u1ecb c\u1ea5y payload, r\u1ee7i ro s\u1ebd lan r\u1ea5t nhanh.<\/figcaption><\/figure>\n\n\n\n

Megalodon \u0111\u00e3 l\u00e0m g\u00ec?<\/h2>\n\n\n\n

Chi\u1ebfn d\u1ecbch n\u00e0y d\u00f9ng nhi\u1ec1u t\u00e0i kho\u1ea3n GitHub d\u00f9ng m\u1ed9t l\u1ea7n, t\u00ean ng\u1eabu nhi\u00ean, r\u1ed3i gi\u1ea3 m\u1ea1o danh t\u00ednh commit quen thu\u1ed9c nh\u01b0 build-bot<\/code>, auto-ci<\/code>, ci-bot<\/code> ho\u1eb7c pipeline-bot<\/code>. Commit message c\u0169ng \u0111\u01b0\u1ee3c ng\u1ee5y trang theo phong c\u00e1ch b\u1ea3o tr\u00ec th\u01b0\u1eddng g\u1eb7p, v\u00ed d\u1ee5 t\u1ed1i \u01b0u pipeline ho\u1eb7c c\u1ea3i thi\u1ec7n th\u1eddi gian build. \u0110\u00e2y l\u00e0 th\u1ee7 thu\u1eadt x\u00e3 h\u1ed9i r\u1ea5t \u0111\u01a1n gi\u1ea3n nh\u01b0ng hi\u1ec7u qu\u1ea3: reviewer nh\u00ecn th\u1ea5y thay \u0111\u1ed5i \u201cc\u00f3 v\u1ebb thu\u1ed9c v\u1ec1 automation\u201d v\u00e0 d\u1ec5 b\u1ecf qua.<\/p>\n\n\n\n

Payload \u0111\u01b0\u1ee3c nh\u00fang v\u00e0o workflow GitHub Actions, c\u00f3 ph\u1ea7n Bash \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a base64. Khi workflow ch\u1ea1y, n\u00f3 c\u1ed1 thu th\u1eadp secret trong runner: bi\u1ebfn m\u00f4i tr\u01b0\u1eddng CI, th\u00f4ng tin trong \/proc\/*\/environ<\/code>, kh\u00f3a AWS, token Google Cloud, credential t\u1eeb instance metadata service, SSH private key, Docker\/Kubernetes config, Vault token, Terraform credential, file .env<\/code>, service account JSON, database connection string, JWT, PEM key, GITHUB_TOKEN<\/code>, token GitLab\/Bitbucket v\u00e0 c\u1ea3 URL\/token d\u00f9ng cho OIDC trong GitHub Actions.<\/p>\n\n\n\n

\u0110i\u1ec3m \u0111\u00e1ng s\u1ee3 kh\u00f4ng n\u1eb1m \u1edf k\u1ef9 thu\u1eadt qu\u00e1 m\u1edbi, m\u00e0 \u1edf c\u00e1ch n\u00f3 \u0111\u00e1nh \u0111\u00fang \u201c\u0111i\u1ec3m t\u1ee5 quy\u1ec1n\u201d. M\u1ed9t runner b\u1ecb compromise c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh b\u00e0n \u0111\u1ea1p sang cloud account, container registry, package registry, kho m\u00e3 ngu\u1ed3n kh\u00e1c ho\u1eb7c h\u1ec7 th\u1ed1ng tri\u1ec3n khai s\u1ea3n xu\u1ea5t.<\/p>\n\n\n\n

B\u1ed1i c\u1ea3nh r\u1ed9ng h\u01a1n: GitHub Actions \u0111ang b\u1ecb s\u0103n l\u00f9ng<\/h2>\n\n\n\n

Megalodon kh\u00f4ng xu\u1ea5t hi\u1ec7n trong kho\u1ea3ng tr\u1ed1ng. Trong th\u00e1ng 05\/2026, The Hacker News c\u0169ng ghi nh\u1eadn v\u1ee5 actions-cool\/issues-helper<\/a>, khi tag c\u1ee7a m\u1ed9t GitHub Action ph\u1ed5 bi\u1ebfn b\u1ecb tr\u1ecf sang commit gi\u1ea3 \u0111\u1ec3 \u0111\u00e1nh c\u1eafp credential CI\/CD. Tr\u01b0\u1edbc \u0111\u00f3, nhi\u1ec1u chi\u1ebfn d\u1ecbch \u0111\u00e3 ch\u1ee9ng minh m\u1ed9t \u0111i\u1ec3m chung: ch\u1ec9 c\u1ea7n ki\u1ec3m so\u00e1t action, tag, token maintainer ho\u1eb7c workflow, attacker c\u00f3 th\u1ec3 bi\u1ebfn h\u1ea1 t\u1ea7ng build c\u1ee7a n\u1ea1n nh\u00e2n th\u00e0nh n\u01a1i t\u1ef1 ch\u1ea1y m\u00e3 \u0111\u1ed9c.<\/p>\n\n\n\n

BleepingComputer c\u0169ng \u0111\u01b0a tin GitHub \u0111i\u1ec1u tra truy c\u1eadp tr\u00e1i ph\u00e9p v\u00e0o kho\u1ea3ng 4.000 repository n\u1ed9i b\u1ed9 b\u1ecb nh\u00f3m TeamPCP tuy\u00ean b\u1ed1 n\u1eafm gi\u1eef, trong b\u1ed1i c\u1ea3nh nh\u00f3m n\u00e0y t\u1eebng li\u00ean quan \u0111\u1ebfn nhi\u1ec1u chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o n\u1ec1n t\u1ea3ng ph\u00e1t tri\u1ec3n v\u00e0 chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m. D\u00f9 c\u00e1c v\u1ee5 vi\u1ec7c c\u00f3 ph\u1ea1m vi v\u00e0 nguy\u00ean nh\u00e2n kh\u00e1c nhau, ch\u00fang cho th\u1ea5y c\u00f9ng m\u1ed9t xu h\u01b0\u1edbng: t\u1ed9i ph\u1ea1m m\u1ea1ng \u0111ang chuy\u1ec3n tr\u1ecdng t\u00e2m t\u1eeb m\u00e1y ch\u1ee7 ch\u1ea1y \u1ee9ng d\u1ee5ng sang h\u1ec7 th\u1ed1ng t\u1ea1o ra \u1ee9ng d\u1ee5ng.<\/p>\n\n\n\n

D\u1ea5u hi\u1ec7u c\u1ea7n ki\u1ec3m tra ngay<\/h2>\n\n\n\n
    \n
  • Workflow m\u1edbi ho\u1eb7c thay \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng trong th\u01b0 m\u1ee5c .github\/workflows\/<\/code>.<\/li>\n
  • Commit message d\u1ea1ng \u201cci\u201d, \u201cbuild\u201d, \u201coptimize\u201d, \u201cpipeline\u201d nh\u01b0ng t\u00e1c gi\u1ea3 kh\u00f4ng thu\u1ed9c nh\u00f3m v\u1eadn h\u00e0nh.<\/li>\n
  • Workflow ch\u1ee9a l\u1ec7nh decode base64, curl\/wget t\u1edbi IP l\u1ea1, ho\u1eb7c thao t\u00e1c \u0111\u1ecdc h\u00e0ng lo\u1ea1t bi\u1ebfn m\u00f4i tr\u01b0\u1eddng.<\/li>\n
  • Job CI\/CD ph\u00e1t sinh k\u1ebft n\u1ed1i outbound t\u1edbi \u0111\u1ecba ch\u1ec9 kh\u00f4ng n\u1eb1m trong danh s\u00e1ch cho ph\u00e9p.<\/li>\n
  • Token cloud, registry ho\u1eb7c GitHub c\u00f3 ho\u1ea1t \u0111\u1ed9ng l\u1ea1 sau ng\u00e0y 18\/05\/2026.<\/li>\n<\/ul>\n\n\n\n

    C\u00e1ch ph\u00f2ng th\u1ee7 th\u1ef1c t\u1ebf<\/h2>\n\n\n\n

    \u0110\u1ea7u ti\u00ean, h\u00e3y coi workflow l\u00e0 m\u00e3 ngu\u1ed3n c\u00f3 \u0111\u1eb7c quy\u1ec1n cao. M\u1ecdi thay \u0111\u1ed5i trong .github\/workflows\/<\/code> n\u00ean b\u1eaft bu\u1ed9c review b\u1edfi ng\u01b0\u1eddi c\u00f3 tr\u00e1ch nhi\u1ec7m b\u1ea3o m\u1eadt ho\u1eb7c DevOps, kh\u00f4ng g\u1ed9p chung v\u1edbi thay \u0111\u1ed5i \u1ee9ng d\u1ee5ng th\u00f4ng th\u01b0\u1eddng.<\/p>\n\n\n\n

    Th\u1ee9 hai, \u00e1p d\u1ee5ng nguy\u00ean t\u1eafc t\u1ed1i thi\u1ec3u quy\u1ec1n cho GitHub Actions. \u0110\u1eb7t permissions:<\/code> \u1edf m\u1ee9c h\u1eb9p nh\u1ea5t, tr\u00e1nh c\u1ea5p quy\u1ec1n ghi m\u1eb7c \u0111\u1ecbnh cho GITHUB_TOKEN<\/code>, t\u00e1ch pipeline build kh\u1ecfi pipeline deploy, v\u00e0 ch\u1ec9 cho workflow ph\u00e1t h\u00e0nh ch\u1ea1y tr\u00ean nh\u00e1nh\/tag \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7.<\/p>\n\n\n\n

    Th\u1ee9 ba, h\u1ea1n ch\u1ebf secret t\u1ed3n t\u1ea1i l\u00e2u trong runner. \u01afu ti\u00ean OIDC v\u1edbi \u0111i\u1ec1u ki\u1ec7n r\u00e0ng bu\u1ed9c ch\u1eb7t theo repository, branch, environment v\u00e0 workflow. V\u1edbi secret t\u0129nh, c\u1ea7n rotation \u0111\u1ecbnh k\u1ef3, scope h\u1eb9p, th\u1eddi h\u1ea1n ng\u1eafn v\u00e0 gi\u00e1m s\u00e1t s\u1eed d\u1ee5ng b\u1ea5t th\u01b0\u1eddng.<\/p>\n\n\n\n

    Th\u1ee9 t\u01b0, pin third-party actions b\u1eb1ng full commit SHA thay v\u00ec tag d\u1ec5 b\u1ecb di chuy\u1ec3n. V\u1edbi action quan tr\u1ecdng, n\u00ean vendor n\u1ed9i b\u1ed9 ho\u1eb7c d\u00f9ng mirror \u0111\u00e3 ki\u1ec3m so\u00e1t. \u0110\u00e2y kh\u00f4ng ph\u1ea3i bi\u1ec7n ph\u00e1p ho\u00e0n h\u1ea3o, nh\u01b0ng gi\u1ea3m \u0111\u00e1ng k\u1ec3 r\u1ee7i ro tag b\u1ecb tr\u1ecf sang commit \u0111\u1ed9c h\u1ea1i.<\/p>\n\n\n\n

    Cu\u1ed1i c\u00f9ng, b\u1ed5 sung ki\u1ec3m so\u00e1t runtime: ch\u1eb7n outbound m\u1eb7c \u0111\u1ecbnh t\u1eeb runner, ch\u1ec9 allowlist domain c\u1ea7n thi\u1ebft, b\u1eadt secret scanning, theo d\u00f5i workflow logs, ki\u1ec3m tra artifact, v\u00e0 c\u1ea3nh b\u00e1o khi workflow \u0111\u1ecdc nhi\u1ec1u file nh\u1ea1y c\u1ea3m ho\u1eb7c g\u1ecdi metadata service b\u1ea5t th\u01b0\u1eddng.<\/p>\n\n\n\n

    Conclusion<\/h2>\n\n\n\n

    Megalodon cho th\u1ea5y m\u1ed9t b\u00e0i h\u1ecdc quan tr\u1ecdng: trong DevSecOps, pipeline kh\u00f4ng ch\u1ec9 l\u00e0 c\u00f4ng c\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a. N\u00f3 l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a bi\u00ean gi\u1edbi b\u1ea3o m\u1eadt. N\u1ebfu attacker ki\u1ec3m so\u00e1t \u0111\u01b0\u1ee3c workflow, ch\u00fang c\u00f3 th\u1ec3 kh\u00f4ng c\u1ea7n ph\u00e1 \u1ee9ng d\u1ee5ng; ch\u00fang ch\u1ec9 c\u1ea7n \u0111\u1ec3 ch\u00ednh h\u1ec7 th\u1ed1ng build c\u1ee7a ch\u00fang ta m\u1edf c\u1eeda cho ch\u00fang.<\/p>\n\n\n\n

    V\u1edbi doanh nghi\u1ec7p \u0111ang d\u00f9ng GitHub Actions, GitLab CI, Jenkins, CircleCI ho\u1eb7c c\u00e1c n\u1ec1n t\u1ea3ng t\u01b0\u01a1ng t\u1ef1, \u0111\u00e2y l\u00e0 th\u1eddi \u0111i\u1ec3m ph\u00f9 h\u1ee3p \u0111\u1ec3 r\u00e0 so\u00e1t l\u1ea1i to\u00e0n b\u1ed9 quy\u1ec1n, secret, workflow v\u00e0 \u0111\u01b0\u1eddng truy\u1ec1n outbound c\u1ee7a runner. Chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m kh\u00f4ng c\u00f2n k\u1ebft th\u00fac \u1edf dependency. N\u00f3 b\u1eaft \u0111\u1ea7u ngay t\u1eeb pipeline.<\/p>\n\n\n\n

    \n\n\n\n

    VNCyberS<\/em><\/strong>
    T\u1ed5ng h\u1ee3p t\u1eeb SafeDep, The Hacker News v\u00e0 BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    Megalodon \u0111\u00e3 ch\u00e8n workflow \u0111\u1ed9c h\u1ea1i v\u00e0o h\u01a1n 5.500 repository GitHub trong v\u00e0i gi\u1edd, nh\u1eafm th\u1eb3ng v\u00e0o secret v\u00e0 credential trong CI\/CD runner. \u0110\u00e2y l\u00e0 b\u00e0i h\u1ecdc th\u1ef1c t\u1ebf v\u1ec1 b\u1ea3o m\u1eadt pipeline v\u00e0 chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m.<\/p>","protected":false},"author":2,"featured_media":1314,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1316"}],"version-history":[{"count":2,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1316\/revisions"}],"predecessor-version":[{"id":1432,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1316\/revisions\/1432"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1314"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}