Loading malware…
SysDiag is a malicious GitHub Actions workflow payload variant observed in the large-scale Megalodon supply-chain campaign targeting GitHub repositories. It is described as the mass variant of the campaign and adds a new workflow file, typically .github/workflows/ci.yml, to compromised repositories. The workflow is configured to trigger broadly on repository activity, including every push and pull request or pull_request_target event, to maximize automated execution across branches.
The payload executes inside victims’ CI/CD pipelines after the malicious commit is merged. It uses a base64-encoded bash payload, described in reporting as a 111-line script, and communicates with a command-and-control server at 216.126.225.129:8443. Reported behavior includes exfiltration of CI/CD secrets, cloud credentials, SSH keys, OpenID Connect tokens, source-code-embedded secrets, CI environment variables, /proc/*/environ and PID 1 environment data, Docker and Kubernetes configuration, Vault tokens, Terraform credentials, shell history, and files such as .env, credentials.json, and service-account.json. The malware also queried AWS IMDSv2, Google Cloud metadata, and Azure IMDS endpoints for live credentials, and searched code and files using more than 30 regex patterns for API keys, JWTs, database connection strings, PEM private keys, and cloud tokens. Reporting also states that the payload attempted to steal GitHub Actions OIDC token request URLs and tokens, enabling potential cloud identity impersonation.
SysDiag was deployed as part of Megalodon, an automated campaign reported by SafeDep and corroborated by OX Security, which pushed 5,718 malicious commits to 5,561 GitHub repositories within roughly six hours on 2026-05-18. The campaign used throwaway GitHub accounts with random usernames and forged CI-themed author identities such as build-bot, auto-ci, ci-bot, and pipeline-bot, along with benign-looking commit messages. High-confidence indicators directly mentioned in the content include the workflow path .github/workflows/ci.yml, the C2 server 216.126.225.129:8443, and forged metadata including build-system@noreply.dev and ci-bot@automated.dev. The campaign targeted software developers and software supply chains by abusing GitHub repositories and CI/CD environments rather than modifying application code directly.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Both variants requested elevated permissions: id-token: write and actions: read, enabling OIDC token theft for cloud identity impersonation.
Megalodon deployed two distinct GitHub Actions workflow variants sharing the same command-and-control server at 216.126.225.129:8443.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets while scanning source code for more than 30 secret regex patterns.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
Both variants requested elevated permissions: id-token: write and actions: read, enabling OIDC token theft for cloud identity impersonation.
The mass variant ( SysDiag ) adds a new workflow triggered on every push and pull request, maximizing automated execution.
The base64-encoded 111-line bash payload conducted aggressive credential harvesting...
Live credentials from AWS IMDSv2, GCP metadata, and Azure IMDS endpoints
GitHub Actions OIDC token request URL and token GITHUB_TOKEN, GitLab CI/CD tokens, and Bitbucket tokens
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets while scanning source code for more than 30 secret regex patterns.
The complete list of data harvested by the malware is below - CI environment variables... Amazon Web Services (AWS) credentials Google Cloud access tokens Instance role credentials obtained by querying AWS IMDSv2, Google Cloud metadata, and Microsoft Azure Instance Metadata Service (IMDS) endpoints
The payload calls a helper function that truncates stolen data into five megabyte chunks, then sends them to the C2 server, with a random delay set to between zero and one seconds...
The base64-encoded 111-line bash payload conducted aggressive credential harvesting, exfiltrating all CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, GitLab CI/CD tokens, and dozens of other secrets...
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A payload variant used in the Megalodon campaign that implants malicious GitHub Actions workflows to execute automatically on pushes and pull requests, enabling secret and credential exfiltration.
A malicious GitHub Actions workflow payload variant used in the Megalodon campaign to execute automatically on pushes and pull requests, steal CI/CD secrets and credentials, and exfiltrate data to a command-and-control server.
A malicious GitHub workflow implant used in the Megalodon campaign that adds a CI workflow file to trigger credential and data theft whenever a developer updates a project.
A malicious GitHub Actions workflow payload used in the Megalodon campaign to execute in CI/CD pipelines, harvest secrets and credentials, and exfiltrate them to attacker-controlled infrastructure at scale.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.