{"id":30390,"date":"2026-07-08T08:55:12","date_gmt":"2026-07-08T07:55:12","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=30390"},"modified":"2026-07-08T08:55:14","modified_gmt":"2026-07-08T07:55:14","slug":"ci-cd-security-supply-chain-attack-from-a-compromised-developer","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2026\/07\/ci-cd-security-supply-chain-attack-from-a-compromised-developer\/","title":{"rendered":"CI\/CD Security: Supply chain attack from a compromised developer"},"content":{"rendered":"\n

In modern DevOps environments<\/strong>, CI\/CD pipelines<\/strong> automate code development, testing, and deployment, enabling rapid delivery and scalability while significantly expanding the attack surface.<\/p>\n

CI\/CD audits conducted in 2025 and 2026 revealed that credentials leaked<\/strong> in repositories, misconfigured runners<\/strong>, insecure artifact stores<\/strong>, and overly permissive cloud roles<\/strong> are all vectors attackers can chain to gain persistent, high-privilege access across the entire infrastructure.<\/p>\n

A high-level overview of DevOps tooling is illustrated below:<\/p>\n

\"Tools
Tools with multiple uses and functions for DevOps<\/figcaption><\/figure>\n

A compromise at any stage of the pipeline can provide a path toward more sensitive systems.<\/p>\n

\"DevOps
DevOps tools that can become a faster way for attackers to obtain a high privilege access on the IS<\/figcaption><\/figure>\n

This article walks through a representative CI\/CD attack kill chain based on observed real-world patterns<\/strong>, highlighting the most commonly exploited vectors and the key hardening measures to reduce the attack surface at every stage of the pipeline, from source code to production deployment.<\/p>\n

\u00a0<\/p>\n

The Kill Chain: from reconnaissance to persistence<\/h2>\n

Reconnaissance and Initial Access<\/h3>\n

The kill chain typically begins with a phishing targeting developers<\/strong> to harvest credentials and MFA codes<\/strong>, though MFA itself can be bypassed through token hijacking or session theft.<\/p>\n

\"Successful
Successful phishing attack<\/figcaption><\/figure>\n

It should be noted that credential compromise alone is not always sufficient<\/strong> to directly access sensitive administrative portals. Security controls protecting Microsoft 365<\/strong> administrative interfaces have been strengthened through the implementation of MFA and, where applicable, Conditional Access policies, limiting the impact of phishing on highly privileged access.<\/p>\n

However, in modern enterprise environments<\/strong> where most business applications<\/strong> rely on Single Sign-On (SSO),<\/strong> the compromise of a Microsoft session (e.g., through session cookie theft) can provide attackers with access to a wide range of interconnected services, including code repositories and CI\/CD platforms. Attackers typically use this initial foothold to identify development environments and establish persistence<\/strong> through mechanisms such as Personal Access Tokens (PATs).<\/strong><\/p>\n

A common but often overlooked risk arises when user accounts are disabled<\/strong> at the identity provider level (e.g., Entra ID<\/strong>) but not fully deprovisioned<\/strong> within repository platforms. In such cases, previously issued PATs<\/strong> may remain valid, allowing attackers to retain repository access despite account revocation.<\/p>\n

Additional entry points include the exploitation of known CVEs<\/strong> and poor credential hygiene. Many major vulnerabilities in DevOps tools are regularly discovered, highlighting the need for continuous vulnerability management. Exploiting a critical<\/strong> vulnerability<\/strong> can directly<\/strong> provide privileged<\/strong> access<\/strong> to a tool in the chain.<\/strong><\/p>\n

Examples include:<\/p>\n