Megalodon: Mass GitHub Backdooring via CI Workflows

Massive supply chain attack known as Megalodon, which targeted over 5,500 GitHub repositories in May 2026. This automated campaign utilised malicious commits disguised as routine maintenance to inject harmful GitHub Actions workflows into various projects. These poisoned workflows were designed to exfiltrate sensitive data, including cloud credentials, API keys, and private SSH secrets, to an external command-and-control server. Notably, the breach affected legitimate software such as Tiledesk, leading to the distribution of compromised packages through the npm registry. Security researchers highlight that the attackers used forged identities and varied triggers to create both immediate and dormant backdoors within the developer ecosystem. This incident underscores a growing era of cyber threats where automated tools are used to compromise the integrity of the global software supply chain.

Видео Megalodon: Mass GitHub Backdooring via CI Workflows канала Juan Romero - SOCFortress Cofounder