The Megalodon GitHub attack shows how quickly CI/CD pipelines can become a mass credential-theft channel. According to the report, attackers pushed 5,718 malicious commits into 5,561 GitHub repositories within a six-hour window, using throwaway accounts and forged bot-like identities such as build-bot, auto-ci, ci-bot, and pipeline-bot. The malicious GitHub Actions workflows contained base64-encoded bash payloads designed to steal CI secrets, cloud credentials, SSH keys, OIDC tokens, and source-code secrets.
This is especially dangerous because the malware executes inside trusted CI/CD runners once repository owners merge or trigger the workflow. The stolen data reportedly includes AWS credentials, Google Cloud tokens, Azure metadata credentials, SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, .env files, GitHub tokens, GitLab CI/CD tokens, Bitbucket tokens, database strings, JWTs, PEM keys, and other secrets. That is not just repository compromise. That is attackers trying to turn build pipelines into cloud breach factories, because apparently software delivery needed more ways to betray everyone.
The campaign also used two observed payload variants: SysDiag, a mass variant triggered on every push and pull request, and Optimize-Build, a more targeted variant triggered manually through workflow_dispatch. This shows that attackers are adapting between noisy scale and quieter operational control depending on the target. It also reflects the broader wave of supply-chain attacks linked to groups like TeamPCP, where one compromise can feed the next across open-source ecosystems.
Organizations should immediately review recent unexpected commits, GitHub Actions workflow changes, new bot-like commit authors, suspicious base64 payloads, and unauthorized changes under .github/workflows/. Security teams should rotate exposed repository, cloud, CI/CD, SSH, Docker, Kubernetes, Vault, Terraform, and package registry credentials where compromise is suspected. They should also restrict who can modify workflows, require reviews for CI/CD changes, limit token permissions, disable unnecessary workflow triggers, and monitor outbound traffic from CI runners.
The larger lesson is simple: CI/CD security is now core infrastructure security. Build pipelines hold the credentials, automation, and deployment authority that attackers want most. Treating workflows as harmless YAML files is no longer acceptable. In 2026, a malicious workflow can be as damaging as malware on a server, only with better access and a more boring file extension.

Cybersecurity researchers have disclosed details of a new automated campaign called Megalodon that has pushed 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window. "Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI

Source: Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows via The Hacker News — published 22 May 2026.