Megalodon malware injects credential-stealing GitHub Actions into 5,500 repos in six hours
Security startup SafeDep uncovered the Megalodon campaign, which added malicious GitHub Actions workflows to over 5,500 repositories in a six‑hour window, exfiltrating cloud credentials, SSH keys and other secrets. The attack uses dummy accounts and backdoor triggers that stay dormant until activated via the GitHub API, highlighting the growing supply‑chain threat.