Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign

A sophisticated supply chain campaign targeting CI/CD infrastructure has been identified by Wiz researchers. The attack, named the "prt-scan" campaign, involved a single attacker operating six separate GitHub accounts to exploit the pull_request_target GitHub Actions trigger—a known vector for code injection in CI/CD pipelines.

This campaign represents a continuation of threats earlier demonstrated by the "hackerbot-claw" campaign, confirming that adversaries are actively developing repeatable tactics against GitHub Actions workflows. The pull_request_target trigger allows pull request code to run in the context of the base branch, creating a critical security boundary issue when combined with malicious inputs.

Wiz researchers traced the attacker's activity back three weeks before public detection, indicating the campaign had been operating covertly while establishing infrastructure across multiple accounts. The use of multiple accounts suggests sophistication in obfuscating attack patterns and distributing malicious actions across the supply chain.

The campaign highlights the ongoing threat to development infrastructure and the need for organizations to audit pull request handling in their CI/CD pipelines.