Loading threat actor…
Megalodon is an automated software supply-chain intrusion campaign focused on compromising GitHub repositories and abusing CI/CD workflows to steal secrets at scale. The operation is characterized by mass injection of malicious commits into public repositories, often using forged bot-like identities and routine-looking CI maintenance messages to blend into normal development activity. If a maintainer merges a poisoned commit, the implanted GitHub Actions workflow executes in the victim’s CI/CD environment and harvests sensitive material from the runner and repository context. Observed Megalodon tradecraft includes malicious GitHub Actions workflow injection, use of compromised personal access tokens or deploy keys for direct repository writes, and secret harvesting from CI environment variables, cloud metadata services, source trees, and developer or infrastructure configuration files. The malware has been reported stealing cloud credentials and tokens associated with AWS, Google Cloud, and Azure; GitHub and Bitbucket tokens; SSH keys; container and Kubernetes configuration; Vault and Terraform secrets; and other embedded credentials identified through broad regex-based scanning. The campaign has also been associated with theft of CI/CD-accessible cloud identities and OIDC-related material, enabling follow-on compromise and propagation. Megalodon has been linked to thousands of malicious commits delivered within a short time window to thousands of GitHub repositories, making it one of the larger publicly reported GitHub-centric supply-chain secret-theft campaigns. Researchers identified multiple payload variants, including SysDiag and Optimize-Build. The latter was observed in a compromise involving Tiledesk, where the attacker reportedly backdoored the GitHub repository rather than the package publisher account, causing poisoned releases to be published from compromised source code. Reported victim repositories also included projects associated with Tiledesk, Black-Iron-Project, and WISE-Community, alongside many smaller repositories. The campaign resembles TeamPCP-style supply-chain operations in technique and scale, particularly around CI/CD compromise and credential theft, but direct attribution to TeamPCP has not been established. Available reporting instead indicates Megalodon is likely a distinct actor or cluster imitating earlier TeamPCP tradecraft. Megalodon is best characterized as a financially motivated or opportunistic supply-chain threat focused on large-scale credential theft and downstream compromise rather than ransomware or destructive operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate campaign focused on injecting malicious GitHub Actions workflows into public repositories to steal CI/CD secrets and cloud credentials.
Automated software supply chain campaign compromising GitHub repositories by pushing malicious commits that add GitHub Actions workflows to exfiltrate CI/CD secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets at scale.
Automated software supply-chain campaign that pushed malicious commits to thousands of GitHub repositories to steal CI/CD and cloud credentials and propagate through poisoned source code.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.