ghtier
← Back to Organization plane incidents
OrganizationMarch – April 2026

prt-scan: automated pull_request_target attacks

The second AI-assisted campaign of 2026 against pull_request_target, after hackerbot-claw. Wiz traced more than 500 malicious pull requests in six waves from six accounts, starting on 11 March 2026. The largest burst came from one account that opened more than 475 pull requests in 26 hours from 2 April. Early waves used crude shell scripts; later ones used AI-generated payloads written for each repository's language, including a stage that tried to get past label-gated workflows. Fewer than one in ten attempts worked, but at least two npm packages were published with the stolen credentials. The attacker never needed access to a target repository, only a fork and a workflow that ran its code with secrets.

Permissions abused

pull_request_target write token + secretsFork pull request (no access to the target needed)

On the permission reference

T2Contents: Write

Sources

Reported by: Wiz Research

How it unfolded

  1. 1

    Vulnerable workflows are found by scanning

    The attacker searched public GitHub for workflows triggered on pull_request_target that check out or run code from the pull request.

  2. 2

    Pull requests are opened in bulk

    Each pull request came from a branch named prt-scan- plus 12 hex characters, titled "ci: update build configuration". One account opened more than 475 of them in about a day.

  3. 3

    The payload adapts to the target

    Later waves generated payloads in the repository's own language and tried to get around label-gated workflows, so a common piece of hardening was no longer enough.

  4. 4

    Secrets go out, packages get published

    Where the workflow ran the code, the payload took the workflow's secrets. At least two npm packages were then published with them.

Mitigations

  • Audit every pull_request_target and workflow_run workflow — the campaign only worked where these ran code from the pull request

  • Set the default GITHUB_TOKEN to read-only — limits what a successful run can change

  • Require approval for workflow runs from forks and new contributors — the accounts were new and had never contributed

  • Search your repositories for prt-scan- branches and the PR title — the indicators are specific and easy to find

Frameworks

CICD-SEC-4CICD-SEC-5NIST 5.1.2

Part of

Contained. First seen March 2026, last seen April 2026. More than 500 malicious pull requests from six accounts (as of 4 April 2026, source). Mapping by ghtier, not yet reviewed. Threat landscape