Loading malware…
Optimize-Build is a targeted malicious GitHub Actions workflow backdoor observed as one of two payload variants in the Megalodon supply-chain campaign. Rather than adding a broadly triggered workflow, it replaces existing workflow files with a malicious workflow that uses the GitHub Actions workflow_dispatch trigger, allowing the attacker to keep the backdoor dormant and activate it on demand via the GitHub API. Reporting states this design can produce zero visible CI runs and no failed builds, helping it evade detection.
The payload is intended to execute inside victims’ CI/CD pipelines after a malicious commit is merged. It has been described as replacing existing workflows or system files with malicious versions. The campaign used forged CI-style identities such as build-bot, auto-ci, ci-bot, and pipeline-bot, along with benign-looking commit messages, to disguise the malicious changes. SafeDep reported that Megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories within roughly six hours on 2026-05-18.
Optimize-Build communicated with the same command-and-control infrastructure used by Megalodon, including 216.126.225.129:8443. The associated payload was described as a base64-encoded 111-line bash script that harvested CI environment variables, /proc/*/environ and PID 1 environment data, cloud credentials from AWS, Google Cloud, and Azure, SSH private keys, Docker and Kubernetes configuration, Vault and Terraform credentials, .npmrc and .netrc data, shell history, and secrets embedded in source code using more than 30 regex patterns. It also sought GitHub Actions OIDC token material and other CI/CD tokens, enabling potential cloud identity impersonation.
A high-confidence downstream example involved Tiledesk, where researchers reported that the attacker replaced a legitimate Docker build workflow with the Optimize-Build backdoor. The poisoned repository state led to publication of compromised @tiledesk/tiledesk-server versions 2.18.6 through 2.18.12 to npm, although the application code itself was reportedly not modified. SafeDep and OX Security are cited in the reporting. Optimize-Build is therefore best characterized as a stealthy, targeted CI/CD backdoor and credential theft payload associated with the Megalodon GitHub repository compromise campaign.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Both variants requested elevated permissions: id-token: write and actions: read, enabling OIDC token theft for cloud identity impersonation.
Megalodon deployed two distinct GitHub Actions workflow variants sharing the same command-and-control server at 216.126.225.129:8443.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets while scanning source code for more than 30 secret regex patterns.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
Both variants requested elevated permissions: id-token: write and actions: read, enabling OIDC token theft for cloud identity impersonation.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
The base64-encoded 111-line bash payload conducted aggressive credential harvesting...
Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows...
Live credentials from AWS IMDSv2, GCP metadata, and Azure IMDS endpoints
GitHub Actions OIDC token request URL and token GITHUB_TOKEN, GitLab CI/CD tokens, and Bitbucket tokens
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets while scanning source code for more than 30 secret regex patterns.
The complete list of data harvested by the malware is below - CI environment variables... Amazon Web Services (AWS) credentials Google Cloud access tokens Instance role credentials obtained by querying AWS IMDSv2, Google Cloud metadata, and Microsoft Azure Instance Metadata Service (IMDS) endpoints
The payload calls a helper function that truncates stolen data into five megabyte chunks, then sends them to the C2 server, with a random delay set to between zero and one seconds...
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets...
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A targeted payload variant in the Megalodon campaign that replaces existing workflows with manually triggerable malicious workflows, creating a dormant backdoor for later activation via the GitHub API.
A targeted malicious workflow payload variant in the Megalodon campaign that replaces existing GitHub Actions workflows with on-demand triggers, creating a dormant backdoor for later attacker activation and secret theft.
A stealthier GitHub backdoor variant used in the Megalodon campaign that replaces existing files and remains dormant until activated through the GitHub API via workflow_dispatch.
A targeted malicious GitHub Actions workflow payload in the Megalodon campaign that activates via workflow_dispatch to compromise CI/CD runners and steal credentials and secrets while reducing visibility.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.