PowerDodder is a stealthy post-exploitation utility that embeds execution commands into frequently accessed but rarely modified script files, minimizing detection by traditional security measures. It scans for potential script files, allows users to append payload commands, and preserves the original file's modification timestamps to evade scrutiny. The tool's name reflects its method of attaching to host scripts for persistent execution.

Attackers can exploit AWS CodeBuild to gain long-term access to compromised accounts by configuring it as a GitHub Actions runner and backdooring an IAM role. This process allows them to persistently execute commands in the AWS environment, even after the original credentials are revoked. Defenders must monitor CloudTrail logs and audit IAM trust relationships to detect such abuses.