Megalodon CI/CD - Bash History Extraction with AWS Activity

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.