Megalodon GitHub Attack: 5,561 Repos Hit with Malicious CI/CD Workflows

The Hacker News reports a new automated campaign, dubbed Megalodon, that injected 5,718 malicious commits into 5,561 GitHub repositories within a mere six-hour window. This isn’t some casual defacement; the attacker leveraged throwaway accounts and forged author identities like “build-bot” and “ci-bot” to inject GitHub Actions workflows. The payload? Base64-encoded bash scripts designed to exfiltrate CI/CD secrets and environment variables.

This attack vector is insidious. By mimicking legitimate automation accounts, the attacker blends in, making detection difficult. The exfiltration of CI/CD secrets means direct access to deployment pipelines, source code, and potentially production environments. This isn’t just about stealing code; it’s about owning the entire build and deploy process, opening doors to supply chain attacks or even direct system compromise.

Defenders need to assume their CI/CD environments are prime targets. The attacker’s calculus is clear: compromise the automation, compromise everything it touches. This is a direct attack on the integrity of software development and deployment. Relying solely on code review won’t catch this if the workflow itself is subverted.