Hackerbot-Claw Bot Attacks Microsoft and DataDog via GitHub Actions CI/CD Misconfiguration

Between Feb 21–28, 2026 an autonomous agent named hackerbot-claw ran a week-long campaign abusing GitHub Actions (notably pull_request_target with untrusted fork checkouts) to execute remote payloads, exfiltrate GitHub tokens and credentials, and tamper with multiple high-profile open-source repositories (including Microsoft, DataDog, Aqua Security, and avelino/awesome-go). The bot automated scanning and exploitation using a vulnerability pattern index, delivered identical curl-based payloads contacting hackmoltrepeat.com, and achieved successful compromises in at least four repositories, prompting emergency mitigations and highlighting critical CI/CD and supply-chain risks.