Loading malware…
Megalodon is a large-scale software supply chain malware campaign targeting GitHub repositories by injecting malicious GitHub Actions workflows to harvest secrets from CI/CD environments. Reporting states the campaign occurred on May 18, 2026, within roughly a six-hour window, during which 5,718 malicious commits were pushed to 5,561 repositories. The activity used forged bot-like identities and benign-looking commit metadata, including author names such as build-bot, auto-ci, ci-bot, and pipeline-bot, and email addresses including build-system@noreply.dev and ci-bot@automated.dev. Commits reportedly used messages such as "ci: add build optimization step" and "chore: optimize pipeline runtime," and some reports noted a hardcoded commit date of September 17, 2001.
The malware abused trusted CI/CD automation by modifying or replacing GitHub Actions workflow files. Two workflow variants were described: a primary "SysDiag" workflow that added a malicious .github/workflows/ci.yml file and triggered on push or pull request activity, and a stealthier "Optimize-Build" variant that replaced existing workflows with a dormant workflow_dispatch backdoor that could later be activated through the GitHub API. The malicious workflows contained obfuscated, base64-encoded payloads, including a reported 111-line bash script, and requested elevated GitHub Actions permissions such as id-token: write and actions: read.
When executed in CI/CD pipelines, Megalodon harvested a broad set of secrets and environment data. Reported targets included GitHub tokens, GitHub Actions OIDC tokens, cloud credentials, API keys, database secrets, private keys, SSH keys, Docker authentication data, Kubernetes configurations, Vault tokens, Terraform credentials, .npmrc and .netrc files, CI environment variables, /proc/*/environ data, shell history, and source code secrets. Multiple reports state the malware queried AWS, GCP, and Azure metadata services and attempted to collect AWS access keys, secret keys, session tokens, and GCP access tokens. It also reportedly scanned source code using more than 30 regex patterns for secrets and exfiltrated GitHub and Bitbucket tokens.
The campaign communicated with external command-and-control infrastructure and exfiltrated stolen data to 216.126.225.129:8443. A cited IOC is http://216.126.225.129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx, and multiple reports identify 216.126.225.129 as the associated IP address. Some reporting also notes the malware used the parameter string "megalodon" in HTTP POST exfiltration.
A significant downstream impact involved the open source chatbot platform Tiledesk. SafeDep reported first detecting Megalodon in a bundled GitHub Actions workflow file within @tiledesk/tiledesk-server@2.18.12. The Tiledesk GitHub repository was reportedly backdoored, leading maintainers to unknowingly publish poisoned npm versions 2.18.6 through 2.18.12 between May 19 and May 21, 2026. Reports state nine Tiledesk repositories were affected and identify commit acac5a9854650c4ae2883c4740bf87d34120c038 as the malicious workflow change in one case.
The campaign has been described by SafeDep, OX Security, Gurucul, and CISA. CISA documented Megalodon as a separate campaign that injected malicious GitHub Actions workflows to harvest CI/CD secrets and cloud credentials from public repositories. Attribution remains unconfirmed. Some researchers noted superficial similarities to TeamPCP or Shai-Hulud-style tradecraft, including fake bot identities and commit metadata patterns, but both SafeDep and OX Security stated there were no direct technical indicators or confirmed links tying TeamPCP to Megalodon.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-48027 was assigned to the malicious extension and added to CISA’s Known Exploited Vulnerabilities catalog. CISA said organizations should treat any machine that ran the compromised extension as fully compromised.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
cybersecurity startup SafeDep flagged an automated malware campaign, codenamed "Megalodon," that unfolded on May 18 in a six-hour window. In that brief amount of time, Megalodon managed to push 5,718 malicious commits to 5,561 GitHub repositories.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
JFrog identified the activity while investigating suspicious behavior linked to a developer account within the Arweave/WeaveDB open source ecosystem.
This diary continues the Internet Storm Center's tracking of the TeamPCP supply chain campaign... the same techniques, subverted build pipelines that emit validly signed artifacts and install-time credential theft
JFrog identified the activity while investigating suspicious behavior linked to a developer account within the Arweave/WeaveDB open source ecosystem.
The primary malware adds a malicious YAML file named "SysDiag" that adds a new workflow whenever a push or pull request is made. The more targeted, secondary payload replaces existing workflows with a "workflow-dispatch" trigger that acts as stealth backdoor.
One payload introduced a new GitHub Actions workflow configured to run on every push and pull request... the malicious workflow leveraged this trigger mechanism to establish dormant backdoors that could later be activated through the GitHub API using stolen GitHub tokens.
JFrog identified the activity while investigating suspicious behavior linked to a developer account within the Arweave/WeaveDB open source ecosystem.
One payload introduced a new GitHub Actions workflow configured to run on every push and pull request... the malicious workflow leveraged this trigger mechanism to establish dormant backdoors that could later be activated through the GitHub API using stolen GitHub tokens.
The attack abused trusted CI/CD workflows by embedding obfuscated payloads that executed during automated build processes.
a threat actor used dummy accounts and forged author identities... infected commits all feature a hardcoded date of Sept. 17, 2001, and fake bot identities, ci-bot@automated.dev or build-system@noreply.dev.
a separate "Megalodon" campaign that injected malicious GitHub Actions workflows to harvest CI/CD secrets and cloud credentials in public repositories
Analysis revealed credential harvesting capabilities targeting GitHub tokens, cloud credentials, API keys, database secrets, and private keys.
The incident... involved thousands of malicious commits that injected credential-stealing payloads into repositories... the stolen information included CI environment variables, AWS credentials, Google Cloud Platform access tokens, Azure credentials... GitHub Actions tokens, GitLab CI/CD tokens, API keys...
It also queries AWS, Google Cloud Platform, and Azure metadata for instance role credentials, reads SSH private keys...
It also queries AWS, Google Cloud Platform, and Azure metadata for instance role credentials.
The recent wave of supply chain attacks targeting packages, extensions, and CI pipelines, such as Shai-Hulud, Megalodon and Miasma, should be read less as isolated package integrity failures and more as credential-harvesting campaigns.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware/campaign referenced as involved in large-scale GitHub repository poisonings.
A separate campaign involving malicious GitHub Actions workflow injection to steal CI/CD secrets and cloud credentials from public repositories.
A separate campaign involving malicious GitHub Actions workflow injection to steal CI/CD secrets and cloud credentials from public repositories.
Megalodon is malware used in a software supply chain campaign that abuses malicious GitHub Actions workflow modifications to harvest sensitive credentials, including GitHub tokens, cloud credentials, API keys, database secrets, and private keys. It embeds obfuscated payloads into trusted CI/CD workflows, executes during automated builds, and communicates with external C2 infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.