Megalodon
Megalodon is an automated software supply-chain campaign targeting GitHub repositories by pushing malicious commits that inject GitHub Actions workflows to steal CI/CD secrets and cloud credentials. Researchers reported 5,718 malicious commits affecting 5,561 repositories within a roughly six-hour window on 2026-05-18, using forged CI-style identities such as build-bot, auto-ci, ci-bot, and pipeline-bot, along with fake bot-like email addresses and routine-looking commit messages. SafeDep assessed the commits were likely pushed using compromised personal access tokens or deploy keys, often directly to master without a pull request. The malicious workflows contained base64-encoded bash payloads and included at least two variants, SysDiag and Optimize-Build. The malware executes in CI/CD pipelines if a maintainer merges the poisoned commit. Reported collection targets include CI environment variables, /proc/*/environ, PID 1 environment data, AWS secret keys, Google Cloud access tokens, AWS/GCP/Azure metadata-service credentials, SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, shell history, GitHub tokens, GitHub Actions OIDC token request URLs and tokens, GitLab CI/CD tokens, Bitbucket tokens, .env files, credentials.json, service-account.json, and source-code secrets matched via more than 30 regex patterns. Exfiltration to 216.126.225[.]129:8443 was reported. The campaign was observed compromising public repositories including Tiledesk, where attackers backdoored the GitHub repository rather than the npm account, leading the maintainer to unknowingly publish poisoned package versions 2.18.6 through 2.18.12; version 2.18.5 was identified as the last clean version. Reported affected repository groups also included Black-Iron-Project and WISE-Community repositories. CISA described Megalodon as a separate campaign that injected malicious GitHub Actions workflows to harvest CI/CD secrets and cloud credentials in public repositories. Multiple sources noted similarities to TeamPCP and Mini Shai-Hulud tradecraft, but Ox Security stated there was no direct threat-intelligence or code-analysis evidence linking Megalodon to TeamPCP and assessed it was likely a different threat actor imitating TeamPCP behavior and style. No additional aliases or sub-groups were identified in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate campaign focused on injecting malicious GitHub Actions workflows into public repositories to steal CI/CD secrets and cloud credentials.
Automated software supply chain campaign compromising GitHub repositories by pushing malicious commits that add GitHub Actions workflows to exfiltrate CI/CD secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets at scale.
Automated software supply-chain campaign that pushed malicious commits to thousands of GitHub repositories to steal CI/CD and cloud credentials and propagate through poisoned source code.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.