Automated ‘Megalodon’ Campaign Spreads GitHub Repo Backdoors

More than 5,000 GitHub repositories fell victim to an automated, malicious campaign, codenamed “Megalodon,” that used fake push requests to steal sensitive information.

See Also: Know Thy Enemy: Threats to Cyber Resilience

“Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads,” said cybersecurity startup SafeDep in a Thursday alert.

Supply-chain attacks targeting open-source JavaScript and Python software repositories have been surging. One of the latest such attacks led to Microsoft-owned GitHub warning Tuesday that hackers stole about 3,800 internal repositories, after one of its developers used a poisoned Visual Studio code extension. TeamPCP, a group of prolific supply-chain hackers, claimed credit for the attack (see: GitHub Hacked, Internal Repositories Offered for Sale).

The Megalodon campaign doesn’t appear to have led to the theft of repositories. Instead, it unleashed a payload inside repositories that targeted continuous integration environment secrets, credentials for cloud services, SSH keys, tokens for secure identity authentication protocol OpenID Connect – aka OIDC federation, as well as secrets inadvertently embedded into source code, SafeDep said.

Researchers at the firm, who focus on protecting software development pipelines from malicious open-source packages and AI supply-chain threats, said the attack also didn’t alter any application code. Instead, it snuck into repositories a malicious workflow file for GitHub Actions, which is a Microsoft-owned, cloud-based development platform, supporting GitHub’s continuous integration and delivery for automatically building, testing and deploying software.

“Code review would catch this, but nobody reviews workflow files in npm packages,” SafeDep said.

The Megalodon ultimately executed 5,718 malicious commits to 5,561 GitHub repositories over a six-hour period. “Once a repository owner merges the commit, the malware executes inside their CI/CD pipeline and propagates further,” said researchers at application security platform Ox Security, which confirmed the campaign.

Attackers used two different types of payloads. “The mass variant (SysDiag) adds a new workflow triggered on every push and pull request, maximizing automated execution. A targeted variant (Optimize-Build) replaced existing workflows with workflow_dispatch triggers, creating dormant backdoors that the attacker can fire on demand via the GitHub API,” SafeDep said.

The firm has published a full list of all affected repositories, as well as indicators of compromise, which includes connections to a hardcoded command-and-control server URL that includes a query string with the word “megalodon” in it, likely to help the attacker track this particular campaign.

The payload calls a helper function that truncates stolen data into five megabyte chunks, then sends them to the C2 server, with a random delay set to between zero and one seconds, the cybersecurity startup said.

SafeDep said it discovered the campaign after finding a payload inside a GitHub Actions workflow file added to a new version of Tiledesk, which is a legitimate, open-source live chat and chatbot platform. Multiple versions of the software, from version 2.18.6 released on Tuesday through version 2.18.12 released on Thursday, contain the backdoor, and all were published by a legitimate project maintainer, through his legitimate account for npm.

“The attacker never touched the npm account. They compromised the GitHub repository, and the maintainer published from the poisoned source without realizing it,” SafeDep said.

Researchers said the attacker appeared to use a compromised GitHub personal access token or deploy key since the malicious commit arrived from an email address – build-bot (build-system@noreply.dev) – with the message “ci: add build optimization step,” which ties to no known GitHub author or committer. After searching GitHub for other commits made from the same email address, researchers discovered the full campaign, which involved the use of four different author names, seven different commit messages as well as “throwaway GitHub accounts with random eight-character usernames.”

The campaign ultimately compromised nine different Tiledesk repositories, eight Black-Iron-Project repos, code tied to WISE Community and “hundreds of smaller repositories,” researchers said.

Maintainers of any repository hit by Megalodon should revert the malicious commits, audit all workflow files, “rotate any secrets available to GitHub Actions runners” as well as “review cloud audit logs for token requests from unknown workflow runs” if the repository uses OIDC federation, researchers said.

Ox Security said the campaign is the latest that’s succeeded by “exploiting simple security loopholes and human errors to spread malicious code at scale,” and noted that unless platform providers do more to intercept malicious code, these attacks will continue to succeed.

Many such attacks continue to be perpetrated by TeamPCP, which specializes in hitting JavaScript and Python software repositories using wormable malware it developed called Shai-Hulud. Earlier this month, the group released online a copy of the malware for free, which other attackers quickly embraced.

“We’ve entered a new supply chain attack era, and TeamPCP compromising GitHub was only the beginning. What’s coming next is an endless wave, a tsunami of cyberattacks on developers worldwide,” Ox Security said.