Reported by 1 outlet
Megalodon Automated Campaign Compromises 5,500+ GitHub Repositories in 6 Hours — CI/CD Secrets and Cloud Credentials Harvested
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Megalodon Automated Campaign Compromises 5,500+ GitHub Repositories in 6 Hours — CI/CD Secrets and Cloud Credentials Harvested
cyberpress.org · 145d ago · May 22nd, 2026
An automated supply chain attack dubbed "Megalodon" pushed 5,718 malicious commits to 5,561 repositories in a single six-hour window on May 18, 2026. Discovered by SafeDep's Malysis engine, the campaign weaponized GitHub Actions workflows using throwaway accounts with randomized 8-character usernames. Two payload variants were deployed: a mass variant (SysDiag) that injected a
.github/workflows/ci.ymlfile auto-triggered on every push/pull request, and a targeted variant (Optimize-Build) usingworkflow_dispatchtriggers that remain dormant until explicitly fired via the GitHub API — leaving zero failed builds, no CI red flags, and no visible workflow runs. The payload exfiltrates environment variables, 27 credential file paths, cloud metadata (AWS IMDSv2, GCP, Azure), OIDC tokens for identity impersonation, and source code. In one confirmed case, the npm package@tiledesk/tiledesk-serverversions 2.18.6–2.18.12 carried the backdoor into production without any application code changes.