Megalodon CI/CD Supply Chain Campaign Backdoors 5,561 GitHub Repos in Six Hours; Dormant workflow_dispatch Triggers Still Active

On May 18, 2026, an automated campaign dubbed Megalodon pushed 5,718 malicious commits to 5,561 distinct GitHub repositories within a six-hour window, injecting GitHub Actions workflows that exfiltrate AWS, GCP, and Azure credentials, SSH keys, OIDC tokens, Kubernetes configs, and over 30 secret regex patterns to a C2 at 216.126.225.129:8443. A targeted variant replaced existing workflows with dormant workflow_dispatch backdoors that produce no visible CI activity and can be silently triggered on demand via the GitHub API — meaning rotation alone does not remediate compromised repos. Hudson Rock confirmed the campaign was seeded entirely from infostealer-harvested GitHub PATs, and the npm package @tiledesk/tiledesk-server versions 2.18.6–2.18.12 carried the payload into the package registry without the maintainer's knowledge.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.