Megalodon Campaign Pushed 5,718 Malicious Commits Into GitHub Repos in Six Hours
An automated backdooring operation abused compromised GitHub credentials to silently inject base64-encoded bash payloads into CI/CD workflows across more than 5,500 public repositories on May 18.
San Francisco — An automated campaign called Megalodon pushed 5,718 malicious commits across 5,561 public GitHub repositories on May 18, 2026, over roughly six hours, using compromised credentials to inject secret-stealing payloads into GitHub Actions workflows, SafeDep researchers disclosed this week.
The operation targeted workflows directly. No pull requests. No merge commits. Attackers used compromised Personal Access Tokens or deploy keys to push changes straight to master branches, bypassing the review controls most teams consider standard.
SafeD ep researchers said they found the campaign while examining a Tiledesk GitHub Actions workflow file containing a base64-encoded bash payload. Tiledesk versions 2.18.6 through 2.18.12 (released May 19 through May 21) all carry the backdoor, they concluded. The malicious commit, identified as acac5a9, was authored by a fabricated identity, "build-bot <build-system@noreply.dev>", with the commit message "ci: add build optimization step" — language designed to blend with legitimate CI activity.
The campaign used additional forged identities including "auto-ci" and "ci-bot." That kind of persona rotation (a detail SafeDep noted was consistent with operational discipline) makes simple author-name filtering an inadequate defense on its own.
Two payload variants were deployed. The first, "SysDiag," embedded obfuscated bash payloads directly into workflow files and fired on every push or pull request. The second, "Optimize-Build," used workflow_dispatch to execute only on demand, reducing noise but leaving detectable traces in the Actions tab — which is precisely how SafeDep spotted the Tiledesk compromise.
Both variants targeted AWS and GCP credentials, SSH keys, Kubernetes configurations, GitHub OIDC tokens, source code secrets, and shell history. Exfiltration ran to attacker-controlled infrastructure at 216.126.225.129:8443.
Among the hardest-hit projects were Wiznet's ioLibrary_Driver repository and four Tiledesk and four persian-tools repositories, with more than 2,000 malicious commits between them.
OX Security separately flagged similarities to the TeamPCP compromise campaign, pointing specifically to hardcoded historical commit dates — a technique used to obscure the true timing of malicious changes. SafeDep's disclosure did not attribute Megalodon to any specific threat actor.
But the operational profile is consistent with credential-harvesting infrastructure built to scale: forged identities, staged payloads, and a six-hour window designed to outrun manual review.
"If you use OIDC federation for cloud deployments, review cloud audit logs for token requests from unknown workflow runs," SafeDep researchers said in their blog post.
SafeDep published a full list of indicators of compromise covering the C2 IP, campaign signatures, forged author names and emails, commit messages, and affected repository names. Organizations using GitHub Actions are advised to audit workflow_dispatch run history and rotate any secrets exposed during CI execution since May 18.
