Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos

A malware campaign, dubbed 'Megalodon', infected thousands of GitHub repositories in six hours, stealing credentials and developer secrets. The attack targeted over 5,500 repositories, exploiting a vulnerability in the GitHub commit process. The malware campaign is believed to be a credential-stealing operation.

1. The Megalodon malware campaign used a custom tool to push malicious commits to GitHub repositories.
2. The attack targeted over 5,500 GitHub repositories, stealing credentials and developer secrets.
3. The malware campaign exploited a vulnerability in the GitHub commit process, allowing for rapid deployment of malicious code.
4. Detection opportunities include monitoring for suspicious commit activity and analyzing repository logs for signs of malicious activity.

T1204.001 User Execution: Malicious Code Execution via GitHub

Megalodon malware, GitHub commit hashes, suspicious repository activity

Implement strict commit access controls and monitor repository activity for signs of malicious behavior to prevent similar attacks.