Megalodon CI/CD - Curl/Wget POST of AWS Tokens

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

This rule detects the explicit use of `curl` or `wget` to exfiltrate data, specifically AWS tokens, to a known Megalodon infrastructure IP address (216.126.225.129). This activity is indicative of the Megalodon CI/CD malware attempting to post extracted data.