Attackers Abuse Kubernetes DNS to Extract Git Credentials from ArgoCD

A newly described attack targets ArgoCD and Kubernetes by abusing Kubernetes DNS to steal Git credentials, potentially giving attackers access to private code repositories. The method relies on CoreDNS within the kube-system namespace; attackers create a rogue Kubernetes service named github in a matching namespace so that DNS lookups for external domains resolve to the attacker’s internal service.

By adding a certificate for github[.]com to ArgoCD, the attacker makes HTTPS connections to the fake service trusted, enabling them to intercept credentials as the ArgoCD repo server communicates with the Git server. If successful, the rogue service can capture credentials such as usernames, passwords, or GitHub tokens and proxy them to the real GitHub to avoid immediate suspicion.

The attack requires a compromised ArgoCD account with permissions to create certificates and applications, as well as access to clusters, repositories, and projects. Defenders are urged to tighten RBAC, restrict certificate creation, monitor for unexpected service names, and audit DNS records and network traffic for suspicious redirections.