Supply‑Chain Attack Hijacks Terraform Provider to Plant Cross‑Platform Malware in Developer Environments

Security researchers have identified a sophisticated supply‑chain campaign that surfaced in July 2026, leveraging a compromised Terraform provider to deliver malware directly into developer workstations and CI/CD pipelines. The malicious provider, disguised as a legitimate infrastructure‑as‑code module, silently installed a two‑stage payload designed to harvest credentials and later expand control over affected systems.

The first stage, dubbed FLATROOF, functions as a credential‑stealing tool. Once the trojanized provider is executed, FLATROOF extracts authentication tokens, API keys, and other secrets stored on the host, transmitting them to command‑and‑control servers. This initial breach grants attackers footholds within development environments, where privileged access is common.

Following successful credential exfiltration, a second component named ROOFDECK is deployed. ROOFDECK provides remote access capabilities, enabling the threat actors to execute arbitrary commands, move laterally across networks, and maintain persistence. Its cross‑platform design allows it to operate on Windows, macOS, and Linux systems, broadening the potential impact across heterogeneous development stacks.

Terraform, an open‑source tool widely used for provisioning cloud resources, has become an attractive target for supply‑chain attacks because its modules are often shared publicly and integrated without thorough verification. By compromising a provider module, the attackers inserted malicious code that runs during routine infrastructure deployments, effectively turning a trusted automation step into a delivery vector for malware.

Attribution for the campaign remains uncertain. The report, originally published by the cybersecurity outlet GBHackers, notes that the tactics, techniques, and procedures (TTPs) resemble those used by previously identified threat groups specializing in developer‑focused espionage, but no definitive link has been established. Analysts are monitoring related activity for indicators that could point to a nation‑state or financially motivated cybercrime organization.

Experts advise organizations to adopt stricter verification of third‑party Terraform modules, implement runtime integrity checks, and enforce least‑privilege principles for development credentials. Enhanced monitoring of unusual outbound traffic from build servers and regular secret rotation can also mitigate the risk of similar supply‑chain compromises in the future.