SafeDep (@safedepio): "🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,<br>- cloud credentials<br>- SSH keys<br>- OIDC tokens<br>- source code secrets

Check your repo / Technical details: https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/" | XCancel

SafeDep

@safedepio

2h

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,<br>- cloud credentials<br>- SSH keys<br>- OIDC tokens<br>- source code secrets

Check your repo / Technical details: safedep.io/megalodon-mass-gi…

Last edited May 21, 2026 · 4:39 PM UTC

10

51

160

37,819

DissentingSkeptic@DissentingS

47s

Replying to @safedepio

They don't try to hide it anymore. Anything with base64 like that is edited. How unoriginal.

12

Eli Nesterov@elinesterov

22m

Replying to @safedepio

Pin your gh actions to hash instead of versions

574

toasts

@t0asts

1h

Replying to @safedepio

36

2,127

Kunal Singh

@KunalSin9h

1h

Replying to @safedepio

we are f*ed up again

1,545

Sudhanshu Dasgupta

@SudhanshuDasgu3

58m

Replying to @safedepio

be prepared for your nightmares

957

M@mmijj_m

47m

Replying to @safedepio

Probably repos of those that got affected by shai hulud. Crazy part is that its over 70k repos that have been hacked.

803

Ilyes Bacha

@dev_ilyesbacha

1h

Replying to @safedepio

1,520

xlr8 •@ransomsec

53m

Replying to @safedepio

lol TF

624

Atharva Vaidya

@atharvavaidya

1h

Replying to @safedepio

Bruh

1,010