logoalt Hacker News

sierra1011yesterday at 11:18 AM0 repliesview on HN

It does install a GitHub runner and registers the infected machine as a runner, so remote code execution remains possible. It might be a stretch to call it persistent but it definitely tries.