TLDR Tech / InfoSec
Megalodon: Mass GitHub Repo Backdooring via CI Workflows
An automated campaign pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window, injecting GitHub Actions workflows with base64-encoded bash payloads that exfiltrate CI secrets, cloud credentials, SSH keys, and OIDC tokens to a C2 at [216.126.225.129]:8443. The targeted variant replaces existing workflows with workflow_dispatch triggers and id-token: write permissions, creating dormant backdoors that produce no visible CI runs and can be fired on demand once an attacker obtains a GITHUB_TOKEN, with the compromise cascading to npm via poisoned publishes of @tiledesk/tiledesk-server 2.18.6 through 2.18.12. Defenders should revert any May 18 commits from build-system@noreply.dev or ci-bot@automated.dev, audit workflow files, rotate all secrets exposed to Actions runners, and review cloud audit logs for OIDC token requests from unknown workflow runs.
Read the full story