Operation Megalodon: Automated Campaign Backdoors 5,561 GitHub Repos via Forged CI Commits in Six Hours, 449GB Exfiltrated

Between 11:36 and 17:48 UTC on May 18, 2026, a campaign tracked as Megalodon (attributed to the TeamPCP syndicate) pushed 5,718 malicious commits to 5,561 GitHub repositories using throwaway accounts and forged author identities mimicking routine CI bots (build-bot, auto-ci, ci-bot, pipeline-bot). Two payload variants were deployed: a mass variant that triggers on every push/PR, and a dormant backdoor variant (Optimize-Build) activatable on-demand via the GitHub API; both exfiltrate cloud credentials, SSH keys, OIDC tokens, and CI secrets to a C2 at 216.126.225.129:8443. As of May 21, the attacker's ingest server showed 575,352 files stolen and 449 GB of exfiltrated data still actively growing — organizations should immediately audit .github/workflows/ directories for unauthorized commits from build-system@noreply.dev or ci-bot@automated.dev and rotate all secrets accessible to affected runners.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.