Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

Megalodon campaign pushed 5,718 malicious commits to 5,561 GitHub repositories to exfiltrate secrets and credentials via infected CI/CD workflows.

• •Attacked repositories using forged identities (build-bot, auto-ci, ci-bot, pipeline-bot) and compromised PATs or deploy keys
• •Malware harvested CI variables, AWS/Google Cloud credentials, SSH keys, OIDC tokens, and 30+ secret patterns
• •Two payload variants observed: SysDiag (triggers on every push/PR) and Optimize-Build (triggers on workflow_dispatch for stealth)
• •Campaign linked to TeamPCP group, known for compromising TanStack, Grafana, and other major open-source projects
• •npm invalidated granular access tokens with 2FA bypass to mitigate the attack

This summary was automatically generated by AI based on the original article and may not be fully accurate.