Megalodon: Mass GitHub Repo Backdooring via CI Workflows
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials. 5,561 repositories were affected in roughly six hours Attackers pushed 5,718 malicious commits. The objective was credential theft from CI/CD environments, including: cloud credentials SSH keys access tokens CI/CD secrets The campaign reportedly used: fake automation-style commit identities such as build-bot, ci-bot, or similar malicious .github/workflows changes workflow triggers that either: executed automatically on push / pull request, or remained dormant until manually triggered Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
Microsoft Sentinel (KQL)
