Megalodon Campaign: Mass CI/CD Poisoning of GitHub Repositories

The Megalodon campaign is a highly automated supply chain attack that compromised over 5,500 GitHub repositories within a six-hour window by poisoning CI/CD pipelines. Threat actors modified .github/workflows/*.yml configuration files to inject malicious scripts designed to exfiltrate developer credentials, cloud provider tokens, and sensitive environment variables. The attack leverages the trusted execution environment of GitHub Actions to capture secrets during the build process and transmit them to external Command and Control (C2) infrastructure. This represents a tactical shift from targeted repository exploitation to mass-scale, automated harvesting of secrets across the software development lifecycle (SDLC).

• Incident Overview: The Megalodon Campaign

  • Mass-scale supply chain attack targeting the DevOps lifecycle via rapid automation.
  • Compromised 5,500+ GitHub repositories in a compressed six-hour execution window.
  • Primary goal is the large-scale exfiltration of high-value secrets and developer identities.

• Attack Vector: CI/CD Workflow Poisoning

  • Weaponization of GitHub Actions through unauthorized modifications to .github/workflows/*.yml files.
  • Use of automated injection scripts that trigger malicious payloads during standard pipeline runs.
  • Technical focus on capturing environment variables and CI/CD secrets available during the runtime of the workflow.

• Scale of Impact: Credential Exfiltration

  • Target data includes cloud provider tokens, API keys, and sensitive developer credentials.
  • Shifted the threat landscape from bespoke, targeted attacks to indiscriminate, high-velocity mass exploitation.
  • Creates significant downstream risk by providing attackers access to linked cloud infrastructure and production environments.

• Defensive Actions: Detection and Mitigation

  • Implement strict monitoring and alerting for any unauthorized changes to the .github/workflows/ directory.
  • Enforce the principle of least privilege for GITHUB_TOKEN permissions to limit the scope of compromised workflows.
  • Utilize automated secret scanning tools to identify and rotate leaked credentials immediately.
  • Audit outbound network traffic from CI/CD runners to identify communication with known C2 infrastructure.

• Conclusion: Evolution of SDLC Threats

  • Demonstrates a critical vulnerability in "Pipeline-as-Code" implementations lacking integrity verification.
  • Highlights the necessity for CISOs to treat CI/CD configurations as high-criticality security assets.
  • Underscores the urgency of adopting immutable pipeline definitions and signed commits to prevent unauthorized modifications.