We regret to inform you that yet *another* GitHub attack is underway—this time compromising GitHub Actions with infostealer scripts.
https://discourse.ifin.network/t/5600-github-accounts-compromised-in-megalodon-attack/490
#ThreatIntel #ThreatIntelligence #IFIN
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-05-21 20:36:35 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-05-21 20:36:35 UTCEvent JSON
{
"id": "7325aaa3cf505cf10ac1f3b0315b5f298554d952ff5c0ada134350eb9f3e354f",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1779395795,
"kind": 1,
"tags": [
[
"t",
"threatintelligence"
],
[
"t",
"ifin"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/@ifin/116614482879284750",
"web"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/116614482879284750",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/116614482879284750",
"pink.momostr"
],
[
"-"
]
],
"content": "We regret to inform you that yet *another* GitHub attack is underway—this time compromising GitHub Actions with infostealer scripts.\n\nhttps://discourse.ifin.network/t/5600-github-accounts-compromised-in-megalodon-attack/490\n\n#ThreatIntel #ThreatIntelligence #IFIN",
"sig": "f3aab0d4a4cc0c071620fdb4f98fac3bf53d7ea7fa152a32618da5f5e71e8f4d70ff47fefbf17a4341eb87a9bb6cee86985e3b7f85a1f6884b97e65d4f5ab518"
}