Megalodon Malware Infects GitHub Repositories Supply Chain | MSSP Advisory

A campaign called Megalodon injected malicious code into over 5,500 GitHub repositories in six hours, stealing developer credentials and secrets through automated commits. The attack targets source code repositories where development teams store API keys, database credentials, and authentication tokens. This represents a supply chain compromise affecting both public and private repositories across GitHub.

Your clients who use GitHub for development work now have potentially compromised repositories containing stolen credentials that attackers can use for lateral movement. Your own development repositories and any automation scripts pulling from GitHub could contain malicious code that gives attackers access to your RMM and PSA environments.

📬