Megalodon Campaign Plants Malicious Workflows in 5,561 GitHub Repos in Six Hours

An automated supply-chain campaign dubbed Megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories inside a six-hour window, researchers tracking the operation said this week. The commits planted GitHub Actions workflow files carrying base64-encoded bash payloads designed to exfiltrate CI/CD secrets the moment a pipeline ran.

The attacker worked from disposable GitHub accounts and forged author identities meant to read as routine automation: build-bot, auto-ci, ci-bot, pipeline-bot. Maintainers reviewing pull-request notifications would, at a glance, see what looked like an in-house service account. That was the point.

The injected .github/workflows files triggered on push and pull_request events, which meant detonation did not require a maintainer to merge anything. A fork plus a PR was enough on repositories with permissive Actions defaults. GitHub's own documentation on workflow permissions has warned about this class of exposure since 2022, when the platform began rolling out read-only GITHUB_TOKEN defaults for new repositories. Older repos were not migrated automatically.

The payloads pulled environment variables, GITHUB_TOKEN values, and any secrets referenced in the workflow, then posted them to attacker-controlled endpoints. Researchers have not publicly named the exfiltration domains.

Volume, not stealth, defined the campaign. Six hours. Roughly 16 commits per minute, sustained. The repositories hit were a mix of personal projects, small open-source libraries, and a smaller number of corporate mirrors, the researchers said. They did not identify which corporate targets, if any, executed the workflows before detection.

GitHub did not respond to a request for comment by deadline. The company has previously said it relies on a combination of rate limiting, abuse heuristics, and Secret Scanning to catch this class of attack. None of those controls, on the evidence of Megalodon, stopped the initial push wave.

And the cleanup falls to maintainers. Each affected repository owner must revoke any secrets that were referenced in a workflow run during the window, rotate GITHUB_TOKEN-derived credentials, and audit branch protection on every default branch. Repositories that auto-merged Dependabot or similar bot PRs during the period warrant closer review.

The campaign fits a pattern researchers have flagged since the 2024 tj-actions/changed-files compromise, tracked as CVE-2025-30066: GitHub Actions is now a first-class target, not a side channel. Workflow files are code, run with credentials, and most organisations do not review them with the same rigour as application source.

GitHub's Trust and Safety team has begun suspending the throwaway accounts, the researchers said. A formal incident advisory from the platform has not been published.