# Megalodon Malware Campaign Poisons 5,500+ GitHub Repositories in Six-Hour Blitz


A sophisticated credential-stealing campaign dubbed "Megalodon" exploited GitHub Actions to inject malware into thousands of open source repositories in a rapid, coordinated attack that exposed CI/CD secrets, cloud credentials, and developer authentication tokens to attackers.


## The Threat


In a devastating six-hour window on May 18, 2026, threat actors executed what security researchers are calling one of the largest automated supply chain attacks to date. The campaign pushed 5,718 malicious commits across 5,561 GitHub repositories, according to findings published by SafeDep, a cybersecurity startup specializing in software supply chain protection.


The attackers used dummy accounts and forged author identities to remain hidden, injecting malicious GitHub Actions workflows designed to exfiltrate sensitive credentials from the development pipeline. The compromised data includes:


  • CI/CD pipeline secrets and environment variables
  • Cloud credentials (AWS, Azure, GCP, and others)
  • SSH keys and private authentication material
  • OpenID Connect (OIDC) tokens for identity federation
  • Source code secrets embedded in repositories
  • API keys and service account credentials

    • SafeDep's Malysis detection engine first identified the campaign when it spotted malicious activity in a GitHub Actions workflow file bundled with the npm package @tiledesk/[email protected], part of the open-source Tiledesk chatbot platform—a clear indicator that the attack targeted widely-used components in the open source ecosystem.


    ## Technical Architecture: A Two-Layered Attack


    The Megalodon campaign employs a sophisticated two-payload design that maximizes both credential theft and persistence:


    ### Primary Payload: "SysDiag" Workflow Injection

    The first payload creates a malicious YAML file named "SysDiag" that automatically activates whenever a push or pull request is made to an infected repository. This ensures the malware runs on every code change, capturing credentials fresh from the CI/CD environment.


    ### Secondary Payload: Stealth Backdoor

    The more insidious component replaces legitimate workflows with a "workflow-dispatch" trigger—a GitHub feature that allows workflows to be activated manually through the GitHub API. According to SafeDep's analysis:


    > *"This makes the backdoor dormant. It creates no visible runs in the Actions tab, no failed builds, no red flags in CI history."*


    This stealth design is particularly dangerous because:


  • No audit trail: The backdoor generates zero visible workflow runs in the repository's Actions tab
  • No failed builds: CI logs remain clean, avoiding alerts that would normally flag malicious activity
  • Silent activation: Attackers can remotely trigger the backdoor through GitHub's API without leaving obvious traces
  • Persistent presence: The workflow remains embedded in the repository configuration until manually discovered and removed

    • ## Background and Context: A Year of Supply Chain Chaos


    The Megalodon campaign arrives amid an escalating wave of software supply chain attacks in 2026. The open source ecosystem, once viewed as a collaborative commons, has become a high-value target for threat actors seeking to compromise thousands of organizations through a single poisoned dependency.


    This attack follows a pattern established by earlier 2026 campaigns that demonstrated the effectiveness of targeting CI/CD pipelines and build automation. GitHub Actions, while powerful for legitimate development teams, creates a natural attack surface: workflows execute with broad access to repository secrets, cloud credentials, and authentication tokens.


    The scale of this campaign—affecting over 5,500 repositories in a single coordinated push—suggests either:


    1. Massive credential compromise: Attackers may have stolen GitHub tokens that grant broad repository access

    2. Account takeover at scale: Compromised developer accounts or bot tokens with widespread permissions

    3. GitHub API vulnerability: A flaw in GitHub's security model that allowed forged author identities to bypass checks


    SafeDep has not publicly disclosed which vector was exploited, though the "forged author identities" detail suggests account compromise rather than a platform vulnerability.


    ## Implications for Development Teams and Organizations


    The Megalodon campaign exposes critical vulnerabilities in how organizations secure their software development pipelines:


    For Development Teams:

  • Every repository listed in SafeDep's report must be treated as compromised
  • All secrets stored as GitHub Actions environment variables are exposed
  • Cloud credentials, SSH keys, and authentication tokens should be considered burned
  • Attackers now possess valid credentials for accessing production environments, cloud accounts, and internal services

    • For Organizations Using Affected Dependencies:

  • The impact extends far beyond the 5,561 directly compromised repositories
  • Any organization that pulled affected versions of @tiledesk or other poisoned npm packages may have executed malicious workflows in their own CI/CD pipelines
  • Downstream supply chain risk is significant: attackers may use exfiltrated cloud credentials to access customer environments

    • For Security Operations:

  • Organizations must assume that all secrets and credentials exposed through CI/CD pipelines are now in attacker hands
  • Lateral movement from compromised CI/CD environments to production systems is a real risk
  • The six-hour execution window suggests attackers are operating rapidly and may already be using stolen credentials

    • ## Recommendations for Defense


    ### Immediate Actions (Next 24 Hours)


    1. Check for infection: Search your dependency trees for any packages that relied on @tiledesk or other flagged repositories. Review GitHub Actions workflow history for unusual commits between May 17-18, 2026.


    2. Rotate all secrets: Treat all CI/CD environment variables, cloud credentials, SSH keys, and API tokens as compromised. Rotate them immediately.


    3. Audit cloud access: Review cloud provider audit logs (CloudTrail, Activity Logs, etc.) for unauthorized access or privilege escalation attempts using exfiltrated credentials.


    4. Review workflow history: Check for hidden or malicious GitHub Actions workflows in compromised repositories. Pay special attention to workflows using the "workflow-dispatch" trigger.


    ### Short-Term Security Measures


  • Implement secrets scanning: Use tools like GitHub's native secrets scanning or third-party alternatives to prevent credentials from being committed to repositories
  • Restrict workflow permissions: Configure GitHub Actions to use least-privilege permissions; avoid granting workflows blanket access to all secrets
  • Enable branch protection: Require code review and approval for workflow file changes; prevent direct commits to default branches
  • Monitor GitHub API activity: Alert on suspicious use of the workflow_dispatch API call pattern

    • ### Long-Term Strategy


  • Shift secrets management: Move away from GitHub Actions environment variables toward dedicated secrets vaults (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault)
  • Adopt ephemeral credentials: Use time-limited OIDC tokens and assume-role patterns instead of long-lived credentials in CI/CD pipelines
  • Enforce code signing: Require commit signatures to prevent forged author identities
  • Zero-trust CI/CD: Treat every GitHub Actions workflow as untrusted; implement network segmentation and access controls around CI/CD execution environments

    • ## The Broader Picture


    Megalodon represents a maturation of supply chain attack tactics. Rather than exploiting a single software vulnerability, attackers are now weaponizing the development infrastructure itself—the GitHub platform, build automation, and credential systems that developers depend on daily.


    The automation and scale of the attack (5,718 commits in 6 hours) suggests this was executed by an organized threat group with significant resources and pre-positioned access. The sophistication of the two-payload design indicates technical maturity and planning.


    ---


    ## HackWire Analysis


    The Real Risk Isn't the Malware—It's What Comes Next


    Most reporting on Megalodon focuses on the immediate credential theft, but the real danger is what attackers will do with those credentials over the coming weeks and months. A six-hour burst of malicious commits is actually the *least* concerning part of this campaign—the dangerous phase happens after, when attackers systematically exploit exfiltrated cloud credentials to establish persistent access in production environments.


    We're seeing a troubling pattern: supply chain attacks are no longer about poisoning software—they're about using the software development pipeline as a beachhead for enterprise compromise. Megalodon wasn't designed to brick GitHub or corrupt code. It was designed to steal the keys to the kingdom: the credentials developers use to deploy infrastructure, manage databases, and access customer data.


    Organizations need to stop thinking about CI/CD security as a development concern and start treating it as a critical infrastructure defense problem. Your CI/CD pipeline has equivalent access to your production environment as a senior DevOps engineer. An attacker with your CI/CD secrets has the same blast radius.


    The stealth backdoor component is particularly insidious because it means organizations could be unknowingly hosting dormant malware in their GitHub repositories for months before it's activated. The threat isn't just the May 18 attack—it's the unknown number of repositories still containing hidden workflow-dispatch backdoors waiting to be triggered.


    Organizations that were compromised need to assume their cloud credentials are burned. Full rotation is not optional. But more importantly, they need to begin the painstaking process of hunting for persistence mechanisms already established in their environments using those stolen credentials. The Megalodon campaign likely isn't the end of the intrusion—it's the beginning.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)