🕵️ Megalodon

The items that name it 8

• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.key entities2026-10-25
• Introducing deny list egress policies for Harden-Runner
  articleas threat actors2026-09-02

  Campaign that compressed harvested credentials from more than 5,500 repositories and posted them to a bare IP on port 8443; that address was added to the Harden-Runner Global Block List and remains there.

• Cloud Threat Highlights: H1 2026
  writeupas threat actors2026-08-06

  Campaign that pushed thousands of malicious commits into public GitHub repositories, backdooring CI workflows at scale.

• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas threat actors2026-07-23

  Campaign targeting GitHub Actions secrets across 5,500 public repositories

• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas threat actors2026-07-16

  May 2026; a single attacker injected backdoored workflow files (named SysDiag, Optimize-Build) into more than 5,500 repositories within a six-hour window, targeting repos without required branch protection review, harvesting cloud credentials, SSH keys, and OIDC tokens.

• Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
  articleas classification.key entities2026-07-16
• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas threat actors2026-07-12

  Exfiltrated secrets across 5,500 public repositories using github.com as exfiltration destination.

• Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity
  writeupas threat actors

  Large-scale supply chain attack campaign that injected malicious GitHub Actions workflows into over 5,500 open-source repositories within a six-hour window on May 18, 2026, to steal CI/CD secrets.