{"id":256095,"date":"2026-05-26T10:02:00","date_gmt":"2026-05-26T14:02:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/26\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos\/"},"modified":"2026-05-26T14:25:21","modified_gmt":"2026-05-26T18:25:21","slug":"github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/26\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos\/","title":{"rendered":"GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos"},"content":{"rendered":"<p><a href=\"https:\/\/www.csoonline.com\/article\/4177124\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos.html\">GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos<\/a><\/p>\n<p><a href=\"https:\/\/www.csoonline.com\/article\/4177124\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos.html\">https:\/\/www.csoonline.com\/article\/4177124\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-05-26 10:02:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.csoonline.com\">www.csoonline.com<\/a><\/p>\n<p>Unexpected workflow_dispatch runs in the Actions tab could be a warning sign, the researchers said in a blog post. \u201cIf you use OIDC federation for cloud deployments, review cloud audit logs for token requests from unknown workflow runs.\u201d<\/p>\n<p>The malicious commits were seen modifying Github Actions workflows to include base64-encoded bash payloads designed to steal secrets exposed during CI execution, including cloud credentials, SSH keys, OpenID Connect (OIDC) tokens, source code secrets, and other environment variables.<\/p>\n<p>Among the hardest-hit projects were Wiznet\u2019s ioLibrary_Driver repository, four Tiledesk repositories, and four persian-tools repositories, with well over 2,000 malicious commits between them.<\/p>\n<p>A later blog post by OX Security flagged some similarities to the widespread TeamPCP compromises, particularly the use of hardcoded historical commit dates. This was a trick used in TeamPCP-linked operations to hide the true timing of malicious activity.<\/p>\n<p><a href=\"https:\/\/www.csoonline.com\/article\/4177124\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos https:\/\/www.csoonline.com\/article\/4177124\/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5500-repos.html Publish&#8230;<\/p>\n","protected":false},"author":1,"featured_media":256096,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.csoonline.com\/wp-content\/uploads\/2026\/05\/4177124-0-97170700-1779804141-shutterstock_177668495.jpg?quality=50&strip=all&w=1024","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[],"class_list":["post-256095","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/256095"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=256095"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/256095\/revisions"}],"predecessor-version":[{"id":256097,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/256095\/revisions\/256097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/256096"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=256095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=256095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=256095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}