Megalodon Malware Hijacks 5,500+ GitHub Repositories in 6 Hours

Key Takeaways

• Over 5,500 GitHub repositories were compromised in a rapid, automated supply chain attack dubbed “Megalodon.”
• Malicious CI/CD backdoors were injected, designed to steal credentials and facilitate cloud identity impersonation.
• The attack leveraged forged identities and camouflaged commit messages to evade detection, impacting projects like Tiledesk.
• Immediate action, including commit reversion and secret rotation, is crucial for affected organizations.

Widespread Megalodon Attack Hijacks GitHub Repositories, Steals Credentials

On May 18, 2026, a sophisticated and highly aggressive automated supply chain attack, now known as “Megalodon,” compromised more than 5,500 GitHub repositories. The incident, which unfolded in less than six hours, involved the injection of malicious CI/CD backdoors into numerous projects, marking a significant escalation in GitHub Actions poisoning campaigns.

Security firm SafeDep meticulously tracked the Megalodon operation, observing 5,718 malicious commits pushed to 5,561 GitHub repositories between approximately 11:36 and 17:48 UTC on May 18, 2026. The attackers utilized ephemeral accounts with randomized eight-character usernames to execute their campaign.

To further obscure their activities, the threat actors employed forged author identities such as “build-bot,” “auto-ci,” “ci-bot,” and “pipeline-bot,” paired with emails like [email protected] and [email protected]. This tactic mimicked legitimate automated CI maintenance processes. Commit messages, including “ci: add build optimization step” and “chore: optimize pipeline runtime,” were crafted to appear innocuous and bypass casual code review.

Megalodon Payload Variants and Credential Theft

The Megalodon campaign deployed two distinct GitHub Actions workflow variants, both communicating with the same command-and-control (C2) server located at 216.126.225.129:8443.

• SysDiag (Mass Variant): This variant introduced a new .github/workflows/ci.yml file. It was configured to trigger on every push and pull_request_target event, ensuring its automated execution across all branches whenever new code was committed.
• Optimize-Build (Targeted Variant): This more stealthy variant replaced existing workflows with a workflow_dispatch trigger. This created a dormant backdoor that attackers could activate silently and on-demand via the GitHub API, without generating any visible CI runs or failed builds.

Both malicious workflow variants requested elevated permissions, specifically id-token: write and actions: read. These permissions are critical for OpenID Connect (OIDC) token theft, enabling attackers to impersonate cloud identities.

Upon execution, the base64-encoded bash payload, a 111-line script, initiated an aggressive, multi-phase credential harvesting process. This included:

• Exfiltration of all CI environment variables, /proc/*/environ contents, and PID 1 environment data.
• Harvesting of AWS credentials (access keys, secret keys, session tokens) from all configured profiles.
• Extraction of GCP access tokens via the gcloud auth print-access-token command.
• Collection of live credentials from AWS IMDSv2, GCP metadata, and Azure IMDS endpoints.
• Theft of SSH private keys, Docker authentication configurations, .npmrc, .netrc, Kubernetes configurations, Vault tokens, and Terraform credentials.
• Scanning of source code using over 30 regular expressions to identify and exfiltrate API keys, JSON Web Tokens (JWTs), database connection strings, PEM keys, and various cloud tokens.
• Theft of GitHub Actions OIDC tokens, directly enabling cloud identity impersonation.

Impact on Tiledesk and npm Supply Chain

The attack had a notable downstream impact on Tiledesk, an open-source live chat platform. The attackers successfully compromised Tiledesk’s GitHub repository, replacing the legitimate Docker build workflow with the “Optimize-Build” backdoor through commit acac5a9. Unaware of the compromise, the maintainer subsequently published versions 2.18.6 through 2.18.12 of the @tiledesk/tiledesk-server package to npm, effectively propagating the backdoor into the package registry. It’s important to note that only the workflow file was altered; the application’s core code remained untouched.

Indicators of Compromise (IoC)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

SafeDep’s Malysis engine initially detected the campaign by flagging the base64-encoded payload within a bundled workflow file in @tiledesk/[email protected]. This highlights the critical role of automated supply chain scanning tools in identifying attacks that can circumvent traditional code review processes.

What You Should Do

Organizations whose repositories received commits from build-system@noreply[.]dev or ci-bot@automated[.]dev on May 18, 2026, must take immediate action:

• Revert Malicious Commits: Identify and revert any suspicious commits, then thoroughly audit all .github/workflows/ files for unauthorized changes.
• Rotate All Secrets: Immediately rotate all secrets, tokens, API keys, SSH keys, and cloud credentials accessible to GitHub Actions runners.
• Audit Cloud Logs: Scrutinize cloud logs for any anomalous OIDC token requests originating from unknown or unexpected workflow runs.
• Check Actions Tab: Review the GitHub Actions tab for any unexpected workflow_dispatch executions.
• Pin GitHub Actions: Pin GitHub Actions to specific commit SHAs instead of mutable version tags to prevent unexpected updates.
• Implement Workflow Approval Gates: Establish workflow approval gates for pull requests, especially those from external contributors, to add an additional layer of review.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.