githash docs

An automated campaign that pushed malicious GitHub Actions workflows into thousands of repositories within hours in May 2026, using throwaway accounts and forged commit identities and dates. The workflows harvest CI secrets, cloud credentials, SSH keys and OIDC tokens and send them to 216.126.225.129:8443. Two variants were seen: one that runs on every push and pull request, and a dormant workflow_dispatch variant that is triggered on demand. Some reporting attributes it to TeamPCP; others assess it as a copycat of their style.

references

• https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
• https://www.protoslabs.io/resources/teampcp-shai-hulud-megalodon-supply-chain-jun-2026

spread over time

Press play to watch the threat spread, or drag the slider to pick dates.

known-malicious hashes · 1,394