Megalodon CI/CD - Credential Regex Search via LOLBins

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Identifies `grep` or `findstr` utilizing decoded regex patterns searching for cloud environment variables locally, specifically looking for patterns like AKIA (AWS Access Key ID), xoxb (Slack Bot User OAuth Token), ghp_ (GitHub Personal Access Token), or npm_ (NPM Access Token). This activity is then correlated with network connections to a specific IP address (216.126.225.129), which is associated with the Megalodon CI/CD malware.