{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/tiledesk/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitHub Actions","Tiledesk"],"_cs_severities":["high"],"_cs_tags":["supply-chain","github","github-actions"],"_cs_type":"advisory","_cs_vendors":["GitHub","NPM"],"content_html":"\u003cp\u003eThe \u0026lsquo;Megalodon\u0026rsquo; supply chain attack targeted GitHub repositories, injecting malicious GitHub Actions workflows designed to steal sensitive information. The attack, discovered by SafeDep, involved the injection of over 5,700 malicious commits within a six-hour window on May 18, 2026. These commits added or replaced workflows to exfiltrate CI environment variables, AWS/GCP/Azure credentials, SSH private keys, Docker/Kubernetes configurations, API keys, database connection strings, and various tokens. Malicious versions of the Tiledesk package, an open source live chat platform, were identified as part of the attack between May 19 and May 21. The attackers exploited GitHub\u0026rsquo;s workflow dispatch feature to create dormant backdoors that could be triggered later.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises the GitHub repository of the Tiledesk package.\u003c/li\u003e\n\u003cli\u003eMalicious commits are authored by \u0026lsquo;build-bot\u0026rsquo; and pushed to repositories on May 18, 2026, across a six-hour window.\u003c/li\u003e\n\u003cli\u003eThe attacker uses two payloads: one adds a new workflow, and another replaces existing workflows.\u003c/li\u003e\n\u003cli\u003eThe new workflow is designed to trigger on every push and pull request.\u003c/li\u003e\n\u003cli\u003eCompromised workflows are designed to exfiltrate CI environment variables, AWS credentials, GCP access tokens, Azure credentials, SSH private keys, Docker and Kubernetes configurations, API keys, database connection strings, GitHub Actions tokens, and GitLab CI/CD tokens.\u003c/li\u003e\n\u003cli\u003eThe attacker exploits the \u0026lsquo;workflow_dispatch\u0026rsquo; feature to create dormant backdoors.\u003c/li\u003e\n\u003cli\u003eStolen GitHub tokens are used to trigger the dormant backdoors via the GitHub API.\u003c/li\u003e\n\u003cli\u003eExfiltrated secrets are used for unauthorized access and potential lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOver 5,500 GitHub repositories were infected, potentially exposing sensitive credentials and secrets. The impact includes unauthorized access to cloud resources (AWS, GCP, Azure), compromised CI/CD pipelines, and potential lateral movement within victim organizations. The vulnerability in Tiledesk allowed attackers to inject malicious code into downstream projects. NPM has invalidated certain access tokens in response.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor GitHub Actions workflow creation events for unexpected or suspicious activity, specifically those authored by \u0026lsquo;build-bot\u0026rsquo; (see Sigma rule: \u0026ldquo;Detect Suspicious GitHub Actions Workflow Creation\u0026rdquo;).\u003c/li\u003e\n\u003cli\u003eImplement stricter code review processes for dependencies, especially open-source packages, to identify malicious commits before integration.\u003c/li\u003e\n\u003cli\u003eEnable and enforce two-factor authentication (2FA) on all GitHub accounts, especially those with write access to repositories.\u003c/li\u003e\n\u003cli\u003eReview and rotate any potentially exposed credentials, keys, and tokens identified in CI/CD environments (reference: Attack Chain step 5).\u003c/li\u003e\n\u003cli\u003eScan GitHub repositories for malicious workflows or commits resembling those injected during the \u0026lsquo;Megalodon\u0026rsquo; attack, focusing on the May 18, 2026 timeframe (reference: Attack Chain step 2).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Malicious Commits with build-bot Author\u0026rdquo; to identify similar malicious commits in your environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-25T07:42:31Z","date_published":"2026-05-25T07:42:31Z","id":"https://feed.craftedsignal.io/briefs/2026-05-megalodon-supply-chain/","summary":"The 'Megalodon' supply chain attack compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to steal credentials, CI secrets, keys, and tokens.","title":"Megalodon Supply Chain Attack Infects Over 5,500 GitHub Repositories","url":"https://feed.craftedsignal.io/briefs/2026-05-megalodon-supply-chain/"}],"language":"en","title":"CraftedSignal Threat Feed — Tiledesk","version":"https://jsonfeed.org/version/1.1"}