Megalodon: Mass GitHub Repo Backdooring via CI Workflows

In the Megalodon campaign, an attacker pushed 5,718 malicious commits across 5,561 GitHub repos in six hours, forging identities like `build-bot` to inject GitHub Actions workflows. The mass variant (`SysDiag`) triggers on every push and pull request, while the targeted variant (`Optimize-Build`) uses `workflow_dispatch` for on-demand secret exfiltration—including AWS/GCP/Azure credentials, OIDC tokens, and SSH keys—to C2 at 216.126.225.129:8443. The attack spread via compromised Tiledesk npm package versions 2.18.6–2.18.12, originating from the legitimate maintainer's GitHub repo, not the npm account.

safedepio