Megalodon CI/CD - Slack Token (xoxb) Harvesting

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects the attempted extraction of Slack API tokens (specifically 'xoxb-' prefixed tokens) from process command lines, combined with network activity to a specific IP address (216.126.225.129). This combination suggests an attempt to harvest and exfiltrate Slack tokens, potentially by the Megalodon CI/CD malware.