Megalodon Campaign Backdoors Thousands of GitHub Repositories via CI/CD Workflows

The cybersecurity landscape is grappling with a significant new supply chain attack, dubbed "Megalodon," which has seen over 5,500 GitHub repositories compromised through their GitHub Actions CI/CD workflows. Disclosed by SafeDep researchers, this campaign represents a shift in attack methodology, moving from poisoning published packages to directly injecting malicious code into the build environment itself. The attack, which took place on May 18, 2026, involved 5,718 malicious commits pushed within a mere six-hour period, affecting projects across various languages and technology stacks. Attackers utilized throwaway GitHub accounts and forged author identities such as "build-bot" and "auto-ci" to mimic routine CI maintenance, thereby evading immediate detection. The injected GitHub Actions workflows contained base64-encoded bash payloads designed to exfiltrate a wide array of sensitive information. This included CI environment variables, AWS and Google Cloud credentials, Azure Instance Metadata Service tokens, SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, shell history, and various API keys and database connection strings. The stolen data was then transmitted to a command-and-control server located at 216.126.225[.]129:8443. The "Megalodon" campaign is distinct from previous supply chain attacks, such as the "Shai-Hulud" campaign that focused on npm packages. By targeting `.github/workflows` files directly, the attackers could execute arbitrary code during CI runs, impacting any repository using GitHub Actions, regardless of whether it publishes to a package registry. This infrastructure-layer compromise means that traditional supply chain security controls focused on package registries are insufficient to protect against this new threat. Researchers observed two primary payload variants: "SysDiag," a mass variant triggered on every push and pull request, and "Optimize-Build," a more targeted variant activated by `workflow_dispatch` for on-demand execution. The implications of such an attack are severe, as compromised CI/CD pipelines have high privileges, accessing repository secrets and deployment credentials. This broadens the blast radius to downstream users of affected open-source projects, not just the maintainers. The incident highlights a critical vulnerability in how workflow files are perceived and reviewed, often treated as configuration rather than executable code, leading to less scrutiny. GitHub faces potential reputational and regulatory pressure if the full scope of the campaign proves extensive, especially for enterprise customers with stringent compliance requirements.