Megalodon mass-poisons 5,561 GitHub repos in a 6-hour window; SysDiag + Optimize-Build workflows exfiltrate cloud credentials and OIDC tokens
SafeDep and OX Security disclosed an automated mass-backdooring campaign tracked as Megalodon that pushed thousands of malicious commits to 5,561 distinct GitHub repositories in a roughly six-hour window on 2026-05-18, using throwaway accounts with forged committer identities such as build-bot, auto-ci, ci-bot and pipeline-bot (SafeDep, 2026-05-21 · OX Security, 2026-05-21 · The Hacker News, 2026-05-22). Two GitHub Actions YAML variants were injected: SysDiag, triggered on every push and pull_request event (T1059.004 Unix Shell via CI Runner) to maximise execution frequency in active repos, and Optimize-Build, which replaces existing workflows with workflow_dispatch triggers — a dormant backdoor that the attacker can activate on demand via the GitHub REST API (T1546 Event Triggered Execution). Both variants carry a base64-encoded bash payload that the SafeDep and OX Security write-ups disassemble in detail.
On execution the payload harvests CI environment variables, /proc/*/environ entries, AWS credentials across configured profiles and IMDSv2 metadata, GCP access tokens via gcloud auth print-access-token, Azure IMDS tokens, SSH private keys from ~/.ssh/, Docker config files, .npmrc, .netrc, Kubernetes configs, Vault tokens, Terraform credentials and — critically for CI/CD trust chains — GitHub Actions OIDC tokens (T1552.004 Private Keys; T1078.004 Cloud Accounts). The npm package @tiledesk/tiledesk-server versions 2.18.6–2.18.12 carries the Optimize-Build variant after the maintainer's GitHub repo was compromised; SafeDep's Malysis engine flagged the package. Detection vantage: audit every .github/workflows/*.yml for the SafeDep-published payload markers and unfamiliar committer identities on recent commits; review CI runner process trees for aws configure list-profiles, gcloud auth print-access-token and curl http://169.254.169.254 calls outside expected infra tests. Hardening: require approval for workflow_dispatch on untrusted branches, gate .github/workflows/ changes behind CODEOWNERS review, adopt OIDC-based trusted publishing to eliminate long-lived cloud credentials, and pin third-party actions to commit SHAs not branch tags.
Why it matters to us: any EU/CH agency, university or contractor with CI/CD reaching cloud infrastructure is exposed if a maintainer they depend on was caught in the 6-hour sweep — re-audit GitHub Actions workflows on internal forks today, and rotate any cloud credentials previously surfaced via CI runners on the affected window.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Execution TA0002
T1059.004Command and Scripting Interpreter: Unix Shell
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Credential Access TA0006
T1552.004Unsecured Credentials: Private Keys
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.