Step Security Details Megalodon’s GitHub Actions Secret-Exfiltration Campaign
Summary
Step Security reports that Megalodon injected malicious workflows into 5,561 GitHub repositories; payloads harvested CI, cloud and source-code secrets and sent them to a listed C2 IP. Tiledesk repositories and npm packages were among those affected.
Key points
- The article says the campaign injected workflows into more than 5,500 repositories during a six-hour period on May 18, 2026.
- It describes direct Poisoned Pipeline Execution (d-PPE): attackers with write access injected workflow changes, exploiting weak branch protection and bypassing pull-request review.
- The base64-encoded bash payload reportedly collected CI environment data, cloud credentials, SSH keys, CI/CD tokens and secrets found in repository files.
- Collected data was compressed and sent by HTTPS POST to 216.126.225.129:8443/collect; the article says the workflow step exited cleanly.
- The article reports 5,561 affected repositories and a SafeDep dataset containing 5,718 malicious commits.
- It identifies nine affected Tiledesk repositories and says the @tiledesk/tiledesk-server package was poisoned in versions 2.18.6–2.18.12.
- The article identifies mandatory pull-request reviews as a primary control against direct workflow injection and notes that unrestricted runner egress enabled exfiltration.
Article Details
- Attack Vectors
- Megalodon injected malicious GitHub Actions workflow files into repositories with weak branch protection, using direct pushes to the default branch.
- The workflows decoded and executed a base64-encoded Bash payload during CI runs to collect environment data, cloud credentials, tokens, private keys, and other secrets.
- The payload compressed collected data and sent it to a C2 server via HTTPS POST.
- Defensive Notes
- Require branch protection with mandatory pull request reviews to prevent unauthorized workflow changes from being pushed directly to the default branch.
- Restrict write access and review workflow YAML changes, which the article says may receive less scrutiny than application code.
- Restrict CI runner outbound network access and monitor or block unexpected connections; the article notes that Harden-Runner job insights showed a blocked outbound connection to the C2 server.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
build-bot@github-ci[.]com | Forged commit author identity listed as a search indicator for repositories receiving malicious commits. | |
ci-pipeline@actions-bot[.]com | Forged commit author identity listed as a search indicator for repositories receiving malicious commits. | |
| IPV4 | 216[.]126[.]225[.]129 | C2 server used by the payload to receive exfiltrated data. |
| SHA1 | acac5a9854650c4ae2883c4740bf87d34120c038 | Commit hash identified as the Tiledesk anchor commit for the campaign. |
| URL | hxxps[:]//216[.]126[.]225[.]129:8443/collect | C2 exfiltration endpoint receiving harvested data via HTTPS POST. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collected data from the CI environment, process environments, workspace files, and local credential files.T1027 · Obfuscated Files or InformationThe workflow contained a base64-encoded payload that it decoded before execution.T1041 · Exfiltration Over C2 ChannelThe payload sent harvested data to its C2 server via HTTPS POST.T1059.004 · Unix ShellThe workflow decoded and executed an inline Bash payload on CI runners.T1071.001 · Web ProtocolsThe payload communicated with its C2 server over HTTPS.T1195.002 · Compromise Software Supply ChainThe article explicitly maps the attack to supply-chain compromise: malicious workflow files were injected into affected repositories.T1528 · Steal Application Access TokenThe payload harvested GitHub Actions OIDC tokens and other CI/CD tokens.T1552.001 · Credentials In FilesThe payload searched files such as .npmrc, Kubernetes configs, Docker registry configs, and workspace files for credentials and secrets.T1552.004 · Private KeysThe payload collected SSH private keys from the runner.T1552.005 · Cloud Instance Metadata APIThe payload collected Azure IMDS responses and instance role credentials.T1560.001 · Archive via UtilityThe payload compressed harvested data with gzip before exfiltration.
Vendors
Products
@tiledesk/tiledesk-serverTiledesk (9 repos) - open source live chat and chatbot platform. npm package @tiledesk/tiledesk-server poisoned across versions 2.18.6–2.18.12; backdoor propagated to downstream consumers via npm registry.GitHub ActionsOn May 18, 2026, a large-scale supply chain attack campaign tracked as Megalodon injected malicious GitHub Actions workflows into over 5,500 open-source repositories within a single six-hour window. The campaignnpmTiledesk (9 repos) - open source live chat and chatbot platform. npm package @tiledesk/tiledesk-server poisoned across versions 2.18.6–2.18.12; backdoor propagated to downstream consumers via npm registry.