And I Would've Gotten Away With It, Too, If It Wasn't For You Meddling Researchers

And I Would've Gotten Away With It, Too, If It Wasn't For You Meddling Researchers

Speakers: Rami McCarthy, Cloud Risk Research Team Lead, Wiz

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=WlQqQ_0kAjs

Overview

Rami McCarthy, who leads the cloud risk research team at Wiz, pulled back the curtain on the process of rapid response research — how a security research organization investigates, coordinates around, and publicly discloses emerging threats in real time. Using the TJ Actions supply chain attack as his primary case study, McCarthy shared a series of vignettes from the incident response journey, each carrying a transferable lesson for anyone doing security research, consuming threat intelligence, or running incident response internally. The talk is less about the technical details of any single attack and more about the tradecraft of being an effective researcher: where to find signal, how to archive ephemeral data, when to stop investigating, and why collaboration is a force multiplier.

Background

▶ Watch: The TJ Actions incident kicked off from a doom-scrolling Friday night discovery (1:00)

The TJ Actions/changed-files incident began in late 2024 when a popular GitHub Action was compromised through a multi-stage supply chain attack. A vulnerable GitHub Action was exploited in November to steal a personal access token (PAT). That PAT was used to compromise a second repository and token, which was used to compromise a third GitHub Action (reviewdog/action-setup) that was updated to point to a malicious fork commit. TJ Actions, which depended on the compromised action, was then briefly taken over. The attacker used the TJ Actions PAT to inject malicious code that exfiltrated secrets from repositories using TJ Actions, publishing them in GitHub workflow logs. Approximately 200 public repositories had their secrets exposed on the internet; many more had internal log exposure.

McCarthy also referenced the Singularity/NX npm supply chain attack that was still unfolding at the time of the talk — noting that 86 valid npm tokens from that attack were still floating around waiting to be abused. The frequency of these supply chain attacks underscores why research teams need robust, repeatable rapid response processes.

Key Findings

▶ Watch: Finding the reviewdog needle in a haystack through supporting friends' incide... (7:30)

McCarthy distilled six lessons from the TJ Actions response:

1. Always be archiving. When the TJ Actions incident kicked off, much of the coordination was happening in a monolithic GitHub issue with hundreds of comments. GitHub nuked the repository to stop the bleeding, taking the entire investigation log with it. McCarthy happened to have a tab open and was able to PDF the issue — pure luck, not foresight. Attacker payloads get deleted, impacted repositories get cleaned up by responders, Slack messages disappear. You cannot rely on data remaining accessible during supply chain incidents.

1. It's not over until it's over. After the initial blog posts and response, things calmed down but no root cause had been identified. This was particularly concerning because it meant another wave of compromise was possible. Good exit criteria for incident response are essential — the Pareto principle applies, but premature closure is dangerous.

1. Research is better with friends. McCarthy's team discovered the reviewdog/action-setup link in the attack chain not through internal analysis alone but through a combination of tracking researcher Adnan's public breadcrumbs on Twitter and supporting friends with their own incident response. A single GitHub Action log from a friend's environment provided the needle-in-a-haystack evidence needed to confirm the next step in the chain. This led to collaboration with the reviewdog maintainer, a CVE, and the ability to trace further up the attack chain.

1. Look everywhere. During the incident, critical information surfaced in public tweets, Twitter DMs, Slack messages, Hacker News comments, and the GitHub fire hose (via GitHub Archive and ClickHouse). The Coinbase targeting, which became major headline news, was first noted in an unnoticed Hacker News comment from a ClickHouse engineer — eight days before it became front-page news. McCarthy's habit of reading every Hacker News comment gave him a significant intelligence advantage.

1. Disclose responsibly. When Wiz discovered Coinbase was specifically targeted, they reached out through responsible disclosure channels and gave both the open-source maintainer and the impacted company time to respond before publishing. Balancing ecosystem urgency against responsible disclosure is a core tension in rapid response research.

1. An Excalidraw is worth a thousand words. Visual artifacts — even ugly ones — are extraordinarily effective for summarizing incidents, getting syndicated by media, and supporting internal communications. McCarthy noted that Wiz's hand-drawn Excalidraw diagrams regularly get syndicated in media coverage of incidents, even when the coverage doesn't reference the Wiz blog post itself.

Technical Deep Dive

▶ Watch: Using GitHub fire hose to stalk researcher activity and fast-follow breaking ... (11:00)

GitHub Fire Hose as an Intelligence Source

McCarthy highlighted the GitHub Archive project, which processes and stores all public GitHub events in queryable formats on both BigQuery and ClickHouse. This data set includes repository creation/destruction, issue activity, branch operations, and watch/fork events. McCarthy used it to monitor researcher Adnan's GitHub activity — watching which repositories he starred, forked, or requested commit access to — which provided early signals about which parts of the attack chain were being investigated. This isn't about "sharking" research; it's about fast-following breaking intelligence so your own research team can contribute and protect customers faster.

The Information Ecosystem Challenge

McCarthy addressed the increasing fragmentation of security information across Slack communities, Discord servers, Signal groups, Twitter/X, and private DMs. His approach to archiving prioritizes volume over organization: take screenshots, save messy data, worry about indexing later. LLMs can process and organize raw data after the fact. The most important thing is to capture information before it disappears.

On filtering noise — particularly AI-generated content and marketing rewrites — McCarthy relies on reputation-based assessment. He knows which researchers produce original work and can quickly skim content to identify whether it contains new information. The recent trend of vibe-coded detection tools appearing on GitHub within hours of a new incident is interesting but currently easy to ignore.

Noise Filtering in the Information Ecosystem

McCarthy addressed the growing challenge of AI-generated content and marketing-driven rewrites polluting the information space during active incidents. When a major supply chain attack breaks, marketing teams across the industry want content — producing pieces that add no new information but are difficult for uninformed readers to distinguish from genuine research. McCarthy's approach is reputation-based: he knows which researchers and teams produce original work and can quickly skim any piece to determine if it contains new findings. He noted that AI slop mostly appears as rewrites after major research teams publish, not during the early breaking-news phase. A newer trend — vibe-coded GitHub repositories appearing within hours of an incident, such as hastily assembled detection tools — is "exciting and interesting and so far easy to ignore."

On the question of when to stop investigating, McCarthy noted that he formally put down the TJ Actions incident when he published a set of five additional breadcrumbs through his personal channels — sharing lower-fidelity leads that Wiz Research wouldn't formally publish but that other researchers could benefit from. The incident context has since been "evicted" from his working memory in favor of more recent npm supply chain attacks.

Demo / Proof of Concept

▶ Watch: Excalidraw magic: why ugly diagrams get syndicated and shared more than blog ... (15:30)

This was a process-and-lessons talk rather than a technical demo. McCarthy walked through the TJ Actions timeline using screenshots from Wiz blog posts, Excalidraw diagrams, and examples of the GitHub fire hose ClickHouse interface to illustrate his investigative process.

Defensive Implications

▶ Watch: Handling decentralized information: archive everything, organize later with LLMs (18:00)

• Instrument your GitHub Action dependencies. The TJ Actions attack exploited transitive trust in the GitHub Actions ecosystem. Pin your actions to specific commit SHAs, not tags.
• Build archiving into your incident response playbook. Don't rely on data remaining accessible. PDF issues, screenshot threads, save payloads before they get cleaned up.
• Define explicit exit criteria for incident response. A root-cause-unknown incident should not be considered closed.
• Invest in community relationships before you need them. Your network is bigger than you think. Most people in the security community will respond to a cold outreach, and the worst outcome is being ignored.
• Monitor alternative data sources. The GitHub fire hose, Hacker News comments, and niche community Slacks often contain critical intelligence before it reaches mainstream channels.
• Support open-source maintainers during incidents. The industry has no formal mechanism to support maintainers whose repositories are compromised. Wiz's collaboration with the reviewdog maintainer is a model worth emulating.
• Create visual artifacts during incidents. Even rough Excalidraw diagrams dramatically improve communication, reporting, and post-incident learning.

Key Takeaways

• Always be archiving — data vanishes during supply chain incidents as both attackers and responders clean up.
• It's not over until it's over — premature closure without root cause identification leaves you vulnerable to a second wave.
• Research is better with friends — your personal network and community relationships provide differentiated intelligence.
• Look everywhere — critical signals appear in Hacker News comments, GitHub fire hose data, and obscure DMs, not just formal advisories.
• Disclose responsibly — balance ecosystem urgency with giving maintainers and impacted companies time to respond.
• An Excalidraw is worth a thousand words — visual incident summaries get syndicated, referenced, and reused far beyond blog posts.

About the Speaker(s)

Rami McCarthy leads the cloud risk research team at Wiz, where his mandate includes investigating emerging threats and protecting both Wiz customers and the broader industry. He previously held security roles in-house and as a consultant. McCarthy is a prolific writer (his blog at tldr-sec.com covers security research process topics), a regular speaker at fwd:cloudsec, and a well-known figure in cloud security community Slacks. He uses a Scooby-Doo Slack photo.