Megalodon: How Infostealers Spawned the 5,000+ Repo GitHub Supply Chain Attack
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<h1>Megalodon: Infostealers Just Spawned a 5,000+ Repo GitHub Supply Chain Attack</h1>
<p>The cybersecurity community was recently rocked by a massive, automated supply chain attack dubbed <strong>Megalodon</strong>. Within a span of just six hours, malicious actors pushed thousands of commits to public GitHub repositories, infecting over 5,000+ repos and injecting a devastating Base64-encoded payload directly into CI/CD workflows.</p>
<p>As initially discovered by <a href="https://www.ox.security/blog/megalodon-cicd-malware-github/" rel="noreferrer" target="_blank">OX Security</a> and further analyzed by <a href="https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows" rel="noreferrer" target="_blank">SafeDep</a>, the Megalodon campaign targeted GitHub Actions. By exploiting weak branch protections and utilizing throwaway or compromised accounts, the attackers deployed workflows designed to drain every secret a runner could reach – including AWS keys, GCP OAuth tokens, SSH private keys, and GitHub OIDC tokens – as well as to deploy additional infostealers to further compromise the targeted environments.</p>
<img alt="Megalodon Attack Flow" src="https://www.infostealers.com/wp-content/uploads/2026/05/attack_flow.png" />
The attack flow of the Megalodon campaign, illustrating how compromised accounts lead to poisoned repositories and subsequent credential theft. (inspired by OX Security)
<img alt="OX Security Base64 Payload Detection" src="https://www.infostealers.com/wp-content/uploads/2026/05/ox_security.png" />
OX Security’s detection of the Base64-encoded Megalodon payload hidden in YAML workflow files.
<img alt="SafeDep Affected Repositories" src="https://www.infostealers.com/wp-content/uploads/2026/05/full_affected_repos_safedep.png" />
SafeDep’s extensive list of affected GitHub repositories (usernames stripped from the repo column).
<h2>The Catalyst: Shai Hulud Goes Open Source</h2>
<p>How did threat actors suddenly acquire the capability to orchestrate such a massive, synchronized campaign? The answer lies in the democratization of malware. Just weeks prior, the financially motivated cybercrime group TeamPCP open-sourced their notorious <em>Shai Hulud</em> framework.</p>
<p>As <a href="https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/" rel="noreferrer" target="_blank">Datadog Security Labs</a> highlighted in their static analysis, the release of this production-grade offensive framework provided a blueprint for credential harvesting and supply chain poisoning. By leaking their own source code, TeamPCP lowered the barrier to entry, effectively inviting a wave of copycat attacks – of which Megalodon is the most severe manifestation.</p>
<img alt="Datadog Shai Hulud Open Source Analysis" src="https://www.infostealers.com/wp-content/uploads/2026/05/shai_hulud_open_source_datadog.png" />
Datadog’s analysis of the Shai Hulud framework being open-sourced, an event that directly enabled the Megalodon proliferation.
<h2>The Hudson Rock Discovery: Infostealers Are the Root Cause</h2>
<p>While the mechanics of the CI/CD injection are well-documented, the origin of the compromised GitHub accounts used to push the malware has remained a question mark. To solve this, <strong>Hudson Rock</strong> analyzed the list of usernames associated with the affected repositories that were observed pushing the infostealer.</p>
<p>By cross-referencing these GitHub usernames against our vast cybercrime intelligence database, we made a startling discovery: <strong>331 out of 978 unique usernames (over 33%) were direct matches to computers infected by infostealers.</strong></p>
<img alt="Hudson Rock Username Cross-Reference" src="https://www.infostealers.com/wp-content/uploads/2026/05/github_mega.png" />
Cross-referencing the affected usernames with Hudson Rock’s identity management feature reveals a staggering 30%+ immediate infection rate.
<img alt="Correlated GitHub Credentials" src="https://www.infostealers.com/wp-content/uploads/2026/05/github_mega1.png" />
For each of these matched infections, there is a correlated github.com credential harvested straight from the infected computer.
<h2>Digging Deeper: The Hidden Infections</h2>
<p>A 33% exact-match rate based solely on usernames is incredibly high, but we suspected the actual number of compromised accounts was near 100%. Usernames on GitHub often don’t identically match the usernames or emails recovered in infostealer logs. To prove this, our researchers conducted a manual deep dive into a username initially determined as “not found” in our database: <code>bryanalexandersantoso</code>.</p>
<img alt="Investigating a Not Found Username" src="https://www.infostealers.com/wp-content/uploads/2026/05/github_mega3.png" />
Investigating a case of an affected username that was initially determined as “not found” in the direct lookup: bryanalexandersantoso.
<p>By analyzing the public commit history of this user, we were able to extract an email address associated with one of their older commits: <code>[email protected]</code>.</p>
<img alt="Email Found in Commit History" src="https://www.infostealers.com/wp-content/uploads/2026/05/github_mega4.png" />
Going through the commits of bryanalexandersantoso reveals the email address [email protected] linked to an old commit.
<p>When we ran this email address through the Hudson Rock database, we immediately identified a recent infostealer infection. This confirms a crucial hypothesis: <strong>Even if a GitHub username isn’t a direct match in an initial scan, deep-dive investigations routinely link the account back to an infostealer infection.</strong></p>
<p>This leads us to a definitive conclusion: The affected accounts enabling the Megalodon supply chain attack are exclusively sourced from infostealer data.</p>
<img alt="Email Correlated to Recent Infection" src="https://www.infostealers.com/wp-content/uploads/2026/05/github_mega2.png" />
The email address [email protected] is directly associated with a recently infected computer, confirming the infostealer origin.
<h2>Introducing Hudson Rock’s Supply Chain Monitoring Feature</h2>
<p>The Megalodon campaign is a stark reminder that if developers and employees are infected with infostealers, platforms like GitHub become the launchpad for devastating cascading events. To combat this, <strong>Hudson Rock has just released a powerful new Supply Chain feature.</strong></p>
<p>This new capability – which can be utilized for any domain – reveals the incredible amount of compromised corporate credentials associated with third-party platforms. When we point this feature at GitHub.com, the results are alarming: <strong>Over 24,000 companies have employees with compromised GitHub credentials.</strong></p>
<img alt="GitHub 24,000+ Companies Compromised" src="https://www.infostealers.com/wp-content/uploads/2026/05/github1.png" />
Our new feature reveals that over 24,000 companies have corporate credentials compromised on github.com due to infostealer infections.
<p>These aren’t just small startups. Our data maps several large, multinational corporations. For example, we identified employees at Anheuser-Busch InBev (<code>an-inbev.com</code>) whose corporate credentials for GitHub have been stolen – exactly the kind of high-value access that enables supply chain attacks.</p>
<img alt="An-Inbev Employee Compromised" src="https://www.infostealers.com/wp-content/uploads/2026/05/github2.png" />
An example showing an employee with an @an-inbev.com email address whose credentials for github.com were compromised.
<p>In other instances, the sheer volume of compromise within a single entity presents a massive risk. For <code>accenture.com</code>, we discovered over 10 distinct employees infected by infostealers who possess credentials to GitHub. If attackers leverage these specific credentials, they could potentially access sensitive, proprietary corporate data stored in private repositories.</p>
<img alt="Accenture Multiple Employees Compromised" src="https://www.infostealers.com/wp-content/uploads/2026/05/github3.png" />
Accenture.com shows over 10 distinct employees infected by infostealers with access to github.com, representing a critical risk to sensitive data.
<p>The supply chain risks extend far beyond GitHub. By mapping the partner ecosystem of a major enterprise like <strong>Dell</strong> (<code>dell.com</code>), our feature identified over <strong>11,000 partners</strong> – such as ABB (<code>abb.com</code>) – whose employees have suffered infostealer infections and had credentials stolen that grant access to Dell’s infrastructure.</p>
<img alt="Dell Supply Chain Partner Ecosystem" src="https://www.infostealers.com/wp-content/uploads/2026/05/dell.png" />
Monitoring the supply chain for Dell reveals over 11,000 compromised partners, highlighting the massive third-party risk landscape.
<h2>The Data: Large Companies with Compromised GitHub Credentials</h2>
<p>To illustrate the sheer scale of the supply chain risks associated with GitHub.com from infostealer infections, we have compiled a list of large companies – out of the 24,000+ companies identified – where Hudson Rock detected at least one compromised corporate credential granting access to GitHub. (e.g., at least one <code>@adobe.com</code> credential belonging to an employee for <code>github.com</code>).</p>
<p><em>Previewing the top companies below. Click the button to expand the full list of companies.</em></p>
<div>
<table>
<thead>
<tr>
<th>Company Name</th>
<th>Primary Domain</th>
<th>Industry</th>
<th>Location</th>
<th>Compromised Employees</th>
</tr>
</thead>
<tbody>
</tbody>
</table>
</div>
View All Companies
<div>
<h2>Don’t Become the Next Supply Chain Victim</h2>
<p>To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here:</p>
<a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">Schedule a Demo</a>
<p>We also provide access to various free cybercrime intelligence tools that you can find here:<br />
<a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a></p>
<p>Thanks for reading, Rock Hudson Rock!</p>
<div>
Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">Hudson Rock</a><br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">@RockHudsonRock</a>
</div>
</div>
The post Infostealers Just Spawned a 5,000+ Repo GitHub Supply Chain Attack appeared first on InfoStealers.
Article Link: Infostealers Just Spawned a 5,000+ Repo GitHub Supply Chain Attack | InfoStealers