(safedep.io) Megalodon Campaign: Large-Scale GitHub Repository Backdooring via Malicious CI Workflows
New large-scale supply chain attack, *Megalodon*, backdoored 5,561 GitHub repos via malicious CI workflows. Attackers injected 5,718 commits with base64-encoded bash payloads exfiltrating CI secrets, cloud creds (AWS/GCP/Azure), SSH keys, and OIDC tokens to C2 (216.126.225.129:8443).
In brief - A sophisticated campaign compromised GitHub repos using forged identities and CI workflows, leading to widespread secret exfiltration and npm package poisoning. Two payload variants enabled both mass-scale and targeted attacks, with elevated permissions facilitating cloud identity theft.
Technically - Attackers leveraged GitHub Actions workflows with two variants: *SysDiag* (automatic trigger on push/pull_request_target) and *Optimize-Build* (dormant, workflow_dispatch-triggered). Payloads used base64-encoded bash scripts to harvest env vars, credential files, AWS CLI/gcloud/IMDS outputs, and 30+ secret types via regex. Anti-forensic measures included error suppression, random sleeps, and cleanup traps. Elevated permissions (id-token: write, actions: read) enabled OIDC token theft and cloud impersonation.
Source: https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows
#Cybersecurity #ThreatIntel
O RLY CYBER
npub1sh…0kwr0
2026-05-21 16:41:23 UTC
Author Public Key
npub1shlut8mwdmfevu2nt294apayu7e0mxs5mrpfyq8v5ru4ymscg9ysx0kwr0Seen on
wss://relay.momostr.pinkPublished at
2026-05-21 16:41:23 UTCEvent JSON
{
"id": "f648fae4d0b0b7face4261aed343ac34eca989a4be9c09bf2f3b30a6e5b245b9",
"pubkey": "85ffc59f6e6ed39671535a8b5e87a4e7b2fd9a14d8c29200eca0f9526e184149",
"created_at": 1779381683,
"kind": 1,
"tags": [
[
"proxy",
"https://swecyb.com/@orlysec/116613557979727564",
"web"
],
[
"t",
"threatintel"
],
[
"t",
"cybersecurity"
],
[
"proxy",
"https://swecyb.com/ap/users/116080658609901341/statuses/116613557979727564",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://swecyb.com/ap/users/116080658609901341/statuses/116613557979727564",
"pink.momostr"
],
[
"-"
]
],
"content": "(safedep.io) Megalodon Campaign: Large-Scale GitHub Repository Backdooring via Malicious CI Workflows\n\nNew large-scale supply chain attack, *Megalodon*, backdoored 5,561 GitHub repos via malicious CI workflows. Attackers injected 5,718 commits with base64-encoded bash payloads exfiltrating CI secrets, cloud creds (AWS/GCP/Azure), SSH keys, and OIDC tokens to C2 (216.126.225.129:8443).\n\nIn brief - A sophisticated campaign compromised GitHub repos using forged identities and CI workflows, leading to widespread secret exfiltration and npm package poisoning. Two payload variants enabled both mass-scale and targeted attacks, with elevated permissions facilitating cloud identity theft.\n\nTechnically - Attackers leveraged GitHub Actions workflows with two variants: *SysDiag* (automatic trigger on push/pull_request_target) and *Optimize-Build* (dormant, workflow_dispatch-triggered). Payloads used base64-encoded bash scripts to harvest env vars, credential files, AWS CLI/gcloud/IMDS outputs, and 30+ secret types via regex. Anti-forensic measures included error suppression, random sleeps, and cleanup traps. Elevated permissions (id-token: write, actions: read) enabled OIDC token theft and cloud impersonation.\n\nSource: https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows\n\n#Cybersecurity #ThreatIntel",
"sig": "b05a7d058e5dbf91f97449a2975ba2dcefb898609ddb4340ed513789a82d8e52ca7d2aa3d84b071f872327c65014a9478be3d5542226d227dcf5c5b2cc878393"
}