Megalodon Campaign Backdoors 5,500+ GitHub Repositories via Malicious CI Workflows

On May 18, 2026, a sophisticated and automated supply chain attack, dubbed "Megalodon," compromised over 5,500 GitHub repositories in a concentrated six-hour period, pushing 5,718 malicious commits. This campaign represents one of the most aggressive GitHub Actions poisoning events observed to date. The attackers employed deceptive tactics, utilizing throwaway GitHub accounts with randomized 8-character usernames and forging author identities such as "build-bot," "auto-ci," "ci-bot," and "pipeline-bot." They used generic commit messages like "ci: add build optimization step" to mimic routine CI maintenance, aiming to evade detection during casual code reviews. The malicious code was embedded within GitHub Actions workflow files, often base64-encoded to further obscure its true nature. Once merged, these backdoored CI workflow files were designed to execute automatically on every push and pull request, or could be silently activated on demand via the GitHub API in a "workflow_dispatch" variant. The primary objective of the payloads was the aggressive exfiltration of sensitive credentials and secrets. This included CI environment variables, AWS credentials, Google Cloud access tokens, Azure Instance Metadata Service (IMDS) credentials, SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, shell history, and various API keys and database connection strings. Notably, the malicious workflows also targeted GitHub Actions OIDC tokens, enabling cloud identity impersonation without static credentials. All harvested data was compressed and transmitted via HTTPS POST to a command-and-control (C2) server located at 216.126.225.129:8443. The attack exploited the typically unrestricted outbound internet access of CI environments, allowing the exfiltration to occur without visible process anomalies or crashes in the workflow execution. Organizations like Tiledesk were significantly impacted, with several of their repositories compromised. The campaign highlighted the critical importance of robust branch protection rules, as repositories lacking mandatory pull request reviews were particularly vulnerable to the injection of unauthorized workflow changes directly into default branches. Security researchers recommend reverting malicious commits, rotating all secrets accessible to GitHub Actions runners, auditing cloud logs for anomalous OIDC token requests, and implementing workflow approval gates for external contributions.