Megalodon Unleashed: GitHub’s CI/CD Pipelines Under Siege in Massive Supply Chain Attack

The Megalodon Menace: GitHub’s CI/CD Pipelines Under Siege

In a chilling demonstration of the escalating software supply chain threat, cybersecurity researchers have unveiled details of an audacious automated campaign dubbed “Megalodon.” This sophisticated attack recently barraged GitHub, pushing an astonishing 5,718 malicious commits to 5,561 distinct repositories within a mere six-hour window. The scale and speed of this operation underscore a dangerous new frontier in cyber warfare, where development pipelines themselves become the primary vector for compromise.

SafeDep, the firm that brought this campaign to light, revealed the attacker’s cunning methodology. Utilizing a rotating cast of throwaway GitHub accounts and forging author identities like “build-bot,” “auto-ci,” “ci-bot,” and “pipeline-bot,” the perpetrators seamlessly injected malicious GitHub Actions workflows. These workflows contained base64-encoded bash payloads designed to systematically exfiltrate a vast array of sensitive data to a command-and-control (C2) server located at 216.126.225[.]129:8443.

A Digital Heist: What Was Stolen?

The list of harvested data reads like a cybercriminal’s wish list, targeting the very lifeblood of modern software development and cloud infrastructure:

• CI environment variables, including sensitive data from /proc/*/environ and PID 1 environment.

• Critical cloud credentials for Amazon Web Services (AWS), Google Cloud, and Microsoft Azure, obtained by querying IMDSv2 and metadata service endpoints.
• SSH private keys, Docker and Kubernetes configurations, and Vault tokens.
• Terraform credentials and shell history.
• API keys, database connection strings, JWTs, PEM private keys, and cloud tokens, identified by over 30 secret regular expression patterns.
• GitHub Actions OIDC token request URLs and tokens, alongside GITHUB_TOKEN, GitLab CI/CD tokens, and Bitbucket tokens.
• Configuration files such as .env, credentials.json, and service-account.json.

One notable victim was the @tiledesk/tiledesk-server package, which unknowingly bundled a Base64-encoded bash payload within its GitHub Actions workflow file.

Two Faces of Attack: SysDiag and Optimize-Build

The Megalodon campaign employed two distinct payload variants, each tailored for different operational objectives:

• SysDiag: A mass-variant workflow triggered on every push and pull request, designed for broad reach and maximum compromise.
• Optimize-Build: A more targeted variant that activates only via workflow_dispatch, a GitHub Actions trigger allowing manual, on-demand workflow execution.

SafeDep highlighted the strategic tradeoff: while on: push guarantees wider execution, workflow_dispatch offers enhanced operational security for the attacker. “With 5,700+ repos compromised, even a small fraction yielding a usable GITHUB_TOKEN gives the attacker enough targets for on-demand triggering,” the report stated. The ultimate goal remains the same: once a malicious commit is merged, the malware executes within the CI/CD pipelines, enabling widespread credential and secret theft.

TeamPCP: The Architects of a New Supply Chain Nightmare

The Megalodon campaign is not an isolated incident but rather a component of a larger, more menacing threat orchestrated by the notorious TeamPCP. As OX Security’s Moshe Siman Tov Bustan grimly observed, “We’ve entered a new supply chain attack era, and TeamPCP compromising GitHub was only the beginning. What’s coming next is an endless wave, a tsunami of cyber attacks on developers worldwide.”

TeamPCP has become adept at weaponizing the interconnected software supply chain, corrupting hundreds of open-source tools and worming its way through various ecosystems. Their victim list is extensive and alarming, including giants like Microsoft-owned GitHub, TanStack, Grafana Labs, OpenAI, and Mistral AI. The group’s attacks foster a cyclical exploitation model, where one compromise feeds the next, allowing malware to spread with terrifying efficiency.

Beyond financial motivations, evidenced by partnerships with extortion crews like LAPSUS$ and VECT, TeamPCP also exhibits geopolitical leanings. The deployment of wiper malware upon detecting machines in Iran and Israel points to a more complex, state-aligned agenda.

The Industry Responds: npm’s Countermeasures

The fallout from TeamPCP’s relentless attack spree, including the “Mini Shai-Hulud worm,” has spurred critical action from the industry. npm, the popular package manager, has proactively invalidated granular access tokens with write access that bypass two-factor authentication (2FA). Furthermore, npm is urging users to transition to Trusted Publishing, a more secure method that reduces reliance on such vulnerable tokens.

While these measures offer a crucial reprieve, the underlying vulnerability persists. As application security firm Socket noted, “By burning every bypass-2FA token on the platform, npm cuts off the credentials the worm has already collected. Maintainers issue new ones. The worm, still active in the wild, goes back to harvesting them. The reset buys breathing room. It does not close the underlying hole.”

Beyond Megalodon: The Evolving Threat Landscape

The Megalodon campaign and TeamPCP’s broader activities highlight a critical shift in the threat landscape. Attackers are increasingly targeting the very infrastructure of software development, exploiting the trust inherent in open-source ecosystems and CI/CD pipelines. As evidenced by other recent incidents, such as the “polymarketdev” account publishing malicious npm packages to steal cryptocurrency, the ingenuity and persistence of these adversaries demand constant vigilance and a proactive, multi-layered security approach from developers and organizations worldwide.

For more details, visit our website.

Source: Link