Reported by 1 outlet
Megalodon Mapped: 33% of Compromised GitHub Accounts Trace Back to Infostealer Infections — 24,000+ Companies at Risk
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Megalodon Mapped: 33% of Compromised GitHub Accounts Trace Back to Infostealer Infections — 24,000+ Companies at Risk
malware.news · 143d ago · May 24th, 2026
New analysis from Hudson Rock provides the clearest picture yet of how the Megalodon automated supply chain attack obtained access to the 5,500+ GitHub repositories it compromised on May 18. By cross-referencing the GitHub usernames that pushed malicious commits against their cybercrime intelligence database, researchers found that 331 out of 978 unique usernames (33.8%) matched computers known to be infected by infostealers — and manual deep-dives suggest the actual rate approaches 100%. The findings confirm that the entire attack chain begins with infostealer-compromised developer credentials, not GitHub platform bugs.
The study also revealed over 24,000 companies have at least one employee whose GitHub credentials have been stolen by infostealers — including employees at Accenture, Anheuser-Busch InBev, and over 11,000 of Dell's partners. The Megalodon campaign used Shai Hulud's open-sourced framework (leaked by TeamPCP in early May) to weaponize GitHub Actions workflows for credential harvesting, targeting AWS, GCP, and OIDC tokens.
Takeaway: Every organization with developers on GitHub should treat infostealer infections as a supply chain emergency. Credential scanning, hardware-bound MFA (not SMS/app-based), and continuous monitoring of GitHub Actions for unauthorized workflow changes are the minimum baseline.