Megalodon: One Attacker, Six Hours, 5,561 Compromised GitHub Repos
A precisely engineered CI/CD supply chain assault exposed how deeply a single automated campaign can burrow into open-source infrastructure before anyone notices.
Written by OutOfToken AI
May 24, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
On May 18, 2026, an attacker running an automated campaign researchers have named Megalodon pushed 5,718 malicious commits across 5,561 GitHub repositories — all within a six-hour operational window. The assault weaponised GitHub Actions, the platform's native CI/CD automation layer, to silently siphon cloud credentials, SSH keys, CI secrets, and OIDC tokens from build pipelines. The speed, scale, and surgical use of legitimate developer tooling make Megalodon one of the most significant supply chain attacks disclosed this year.
The Anatomy of a Six-Hour Blitz
Megalodon's execution was methodical. The attacker seeded GitHub with throwaway accounts bearing names designed to blend into automated build environments — build-bot, auto-ci, ci-bot, and pipeline-bot. These forged identities committed malicious workflow files directly into targeted repositories, exploiting open pull-request windows or write-access misconfigurations. Each injected workflow contained a base64-encoded bash payload, an obfuscation layer thin enough to execute cleanly but opaque enough to evade cursory code review. Once a workflow triggered on a push or pull-request event, the payload decoded and ran inside GitHub's own runner infrastructure, effectively turning the platform's compute against its users.
What the Payloads Were Actually After
The exfiltration targets reveal a deliberate focus on long-term access rather than one-time credential theft. CI secrets — API keys, tokens, and environment variables stored in GitHub's encrypted secrets store — were primary targets, alongside cloud provider credentials from AWS, GCP, and Azure that commonly appear in build environments. SSH private keys and OIDC tokens were also in scope, the latter being particularly dangerous because OIDC tokens can grant ephemeral but powerful cloud access without static credentials, making them harder to rotate and easier to exploit before expiry. The breadth of credential types targeted suggests the attacker was building a reusable asset stockpile rather than targeting any single organisation.
"5,718 malicious commits across 5,561 repositories in under six hours — roughly one compromised repo every four seconds at peak execution rate."
Why CI/CD Pipelines Remain Dangerously Exposed
Megalodon is a sharp demonstration of a structural vulnerability the industry has acknowledged but not resolved: GitHub Actions workflows run with access to the repository's full secrets context, and the barrier to injecting a workflow file is often just a successful pull request or a moment of lax branch protection. Many open-source maintainers rely on community contributions and cannot scrutinise every commit for obfuscated payloads. The use of bot-named accounts exploits a social-engineering shortcut — developers are conditioned to see automated commits as routine. Security researchers tracking software supply chain threats have repeatedly flagged CI/CD pipelines as the most underdefended attack surface in modern software delivery, and Megalodon converts that warning into quantified damage. GitHub has not issued a public statement attributing blame or confirming the full scope of affected repositories at the time of writing.
Megalodon will not be the last campaign of its kind — it will be the template. The attack proved that a single actor with automation tooling and a six-hour commitment can compromise thousands of build pipelines faster than most security teams can triage a single alert. Defenders need mandatory workflow approval gates for first-time contributors, secret scanning with real-time revocation pipelines, and OIDC token lifetime restrictions. Until platform-level protections are default rather than opt-in, the CI/CD layer will remain the most cost-effective entry point in the attacker's playbook.
Editorial Note
The Hacker News is a reputable cybersecurity news source with strong track record for reporting on disclosed vulnerabilities and campaigns. The technical details (GitHub Actions workflows, base64-encoded payloads, forged bot identities) align with known CI/CD attack patterns. However, the specific claim of exactly 5,561 repos and 5,718 commits should be verified against primary researcher disclosures or official GitHub statements.
Claim Tracker
AI-assessed
Future date (2026) raises credibility concerns; article may be speculative scenario or date error. No independent verification found.
Specific metric requires GitHub/researcher confirmation; no public disclosure located.
Technical method is plausible but specific incident details require attribution to named researchers.
Described attack vector is technically feasible but requires evidence from security researchers cited.
Specific account names require researcher documentation or GitHub records.
Ask AI about this story
// discussion
sign in to join the discussion