#megalodon — Public Fediverse posts

A simple repair job at home should be easy and accessible. Whether you've got a new shelf to put together or an old dishwasher that needs some TLC, Megalodon is packed to the gills with practicality for all those everyday household projects.

https://www.ifixit.com/products/megalodon-driver-kit
—
#iFixit #RightToRepair #Megalodon #FixItYourself #RepairDontReplace #DIYRepair

A simple repair job at home should be easy and accessible. Whether you've got a new shelf to put together or an old dishwasher that needs some TLC, Megalodon is packed to the gills with practicality for all those everyday household projects.

https://www.ifixit.com/products/megalodon-driver-kit
—
#iFixit #RightToRepair #Megalodon #FixItYourself #RepairDontReplace #DIYRepair

MEGALODÓN (Argentina) presenta nou àlbum: "Putrido" #Megalodón #Slam #BrutalDeathcore #Juliol2026 #Argentina #NouÀlbum #Metall #Metal #MúsicaMetal #MetalMusic

No bueno
https://www.discovermagazine.com/long-lost-megalodon-fossils-confirm-the-giant-shark-could-reach-80-feet-long-49303?utm_source=firefox-newtab-en-us #sharks #megalodon #paleontology

No bueno
https://www.discovermagazine.com/long-lost-megalodon-fossils-confirm-the-giant-shark-could-reach-80-feet-long-49303?utm_source=firefox-newtab-en-us #sharks #megalodon #paleontology

the Meg (oil on illustration board, 2014)

#megalodon #greatwhite #shark #fossils #giantfish #illustration #art #science #research #artandscience #Paläontologie #sea #vertebrate

the Meg (oil on illustration board, 2014)

#megalodon #greatwhite #shark #fossils #giantfish #illustration #art #science #research #artandscience #Paläontologie #sea #vertebrate

🔥 TRENDING

📢 Megalodon kompromittiert 5.561 GitHub-Repositories in sechs Stunden - Security-Insider

🔗 https://news.google.com/rss/articles/CBMizgFBVV95cUxPZzd5NXFYX0d3LXhEQUxKN2xmNDhDYnl0Sjd4NzRWUjNhcjI0amU5N0xxWjJqTkIzUHlOSDdkRjAwUkRMNHBMazhCQ2Y0VmtIT21xZkxZUE5BUHJaMEhkNmI3Q0VxWUhyaHh1TGdHb2JzbUItR3hhblc4bzQydHlPNVpWT2F4bkwtT002aGdvQ3M3cHhCVXR3VEFjOVRqdzB4VVRBR0xjWjN5Sk5TWjB5UWVsZElkc2YwdlFEMWdvb01xVTV2Znd0c1FMd1BrUQ?oc=5

#Megalodon #Github-repositories #Stunden #Security-inside...

5,7 tys. commitów w 6 godzin. Repozytoria GitHub zainfekowane w kampanii “megalodon”

Badacze z SafeDep wykryli zautomatyzowaną kampanię – nazwaną megalodon – w ramach której wypchnięto ponad 5,7 tysięcy złośliwych commitów w ponad 5,5 tysiącach repozytoriów na GitHub. Całość zajęła ~6 godzin. Korzystając z jednorazowych kont atakujący wstrzyknęli złośliwe workflow GitHub Actions zawierające zakodowane w base64 payloady (bash), które wykradają sekrety CI,...

#Aktualności #Bezpieczeństwo #Github #Kampania #Megalodon

https://sekurak.pl/57-tys-commitow-w-6-godzin-repozytoria-github-zainfekowane-w-kampanii-megalodon/

5,7 tys. commitów w 6 godzin. Repozytoria GitHub zainfekowane w kampanii “megalodon”

Badacze z SafeDep wykryli zautomatyzowaną kampanię – nazwaną megalodon – w ramach której wypchnięto ponad 5,7 tysięcy złośliwych commitów w ponad 5,5 tysiącach repozytoriów na GitHub. Całość zajęła ~6 godzin. Korzystając z jednorazowych kont atakujący wstrzyknęli złośliwe workflow GitHub Actions zawierające zakodowane w base64 payloady (bash), które wykradają sekrety CI,...

#Aktualności #Bezpieczeństwo #Github #Kampania #Megalodon

https://sekurak.pl/57-tys-commitow-w-6-godzin-repozytoria-github-zainfekowane-w-kampanii-megalodon/

5,7 tys. commitów w 6 godzin. Repozytoria GitHub zainfekowane w kampanii “megalodon”

Badacze z SafeDep wykryli zautomatyzowaną kampanię – nazwaną megalodon – w ramach której wypchnięto ponad 5,7 tysięcy złośliwych commitów w ponad 5,5 tysiącach repozytoriów na GitHub. Całość zajęła ~6 godzin. Korzystając z jednorazowych kont atakujący wstrzyknęli złośliwe workflow GitHub Actions zawierające zakodowane w base64 payloady (bash), które wykradają sekrety CI,...

#Aktualności #Bezpieczeństwo #Github #Kampania #Megalodon

https://sekurak.pl/57-tys-commitow-w-6-godzin-repozytoria-github-zainfekowane-w-kampanii-megalodon/

5,7 tys. commitów w 6 godzin. Repozytoria GitHub zainfekowane w kampanii “megalodon”

Badacze z SafeDep wykryli zautomatyzowaną kampanię – nazwaną megalodon – w ramach której wypchnięto ponad 5,7 tysięcy złośliwych commitów w ponad 5,5 tysiącach repozytoriów na GitHub. Całość zajęła ~6 godzin. Korzystając z jednorazowych kont atakujący wstrzyknęli złośliwe workflow GitHub Actions zawierające zakodowane w base64 payloady (bash), które wykradają sekrety CI,...

#Aktualności #Bezpieczeństwo #Github #Kampania #Megalodon

https://sekurak.pl/57-tys-commitow-w-6-godzin-repozytoria-github-zainfekowane-w-kampanii-megalodon/

5,7 tys. commitów w 6 godzin. Repozytoria GitHub zainfekowane w kampanii “megalodon”

Badacze z SafeDep wykryli zautomatyzowaną kampanię – nazwaną megalodon – w ramach której wypchnięto ponad 5,7 tysięcy złośliwych commitów w ponad 5,5 tysiącach repozytoriów na GitHub. Całość zajęła ~6 godzin. Korzystając z jednorazowych kont atakujący wstrzyknęli złośliwe workflow GitHub Actions zawierające zakodowane w base64 payloady (bash), które wykradają sekrety CI,...

#Aktualności #Bezpieczeństwo #Github #Kampania #Megalodon

https://sekurak.pl/57-tys-commitow-w-6-godzin-repozytoria-github-zainfekowane-w-kampanii-megalodon/

This is not about the nature of "AI", it is about the corporations who are building it. These corporations are well within the definition of pleonexia: those who take more than their fair share.

They are taking far more than their fair share of money, of the earth's resources, and now they are taking more than their fair share of our data, of the stories of our lives.

They are hooking the mobile phone users into a common nervous system, with them the center.

This development is very obvious to those who have access to the concepts of system network design.

The "loci of agency and intent" model of the central actor in social and political contexts, is a mathematical form, and so it is scale invariant. If you find anything like such a locus, feel free to go ahead and give it a name, as its form will be relatively stable over time.

Here such loci live in the waters of the global financial systems, megalodons who swim in the same substance as the minnows.

The minnows never notice. And if they notice the shadow, they have little real concept of what it is thinking.

#ai #fascists #megalodon

This is not about the nature of "AI", it is about the corporations who are building it. These corporations are well within the definition of pleonexia: those who take more than their fair share.

They are taking far more than their fair share of money, of the earth's resources, and now they are taking more than their fair share of our data, of the stories of our lives.

They are hooking the mobile phone users into a common nervous system, with them the center.

This development is very obvious to those who have access to the concepts of system network design.

The "loci of agency and intent" model of the central actor in social and political contexts, is a mathematical form, and so it is scale invariant. If you find anything like such a locus, feel free to go ahead and give it a name, as its form will be relatively stable over time.

Here such loci live in the waters of the global financial systems, megalodons who swim in the same substance as the minnows.

The minnows never notice. And if they notice the shadow, they have little real concept of what it is thinking.

#ai #fascists #megalodon

🕵🏻‍♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.

#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.

The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.

→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack

If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

🕵🏻‍♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.

#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.

The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.

→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack

If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

🕵🏻‍♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.

#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.

The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.

→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack

If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

🕵🏻‍♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.

#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.

The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.

→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack

If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

🕵🏻‍♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.

#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.

The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.

→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack

If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

Otodus megalodon (Agassiz, 1843)
Provenienza : South Carolina, USA
Età : Miocene

nessun restauro - originale

Dimensioni: mm 12,63 - 4,97 inch

#megalodon #shark #fossils #fossile #dentedisqualo #fossilesqualo

https://geocollection.net/it/denti-di-squalo/878-otodus-megalodon-agassiz-1843.html

#TeamPCP war gestern – Auftritt #Megalodon

TeamPCP hatte auf GitHub rund 3.800 Repositories kontaminiert. Jetzt kommt Megalodon und vergiftet auf Anhieb 5.561 Repos (Stand 2026-05-22). Damit erleben wir einen weiteren, noch größeren Lieferketten-Angriff als mit TeamPCP. Etliche Fragen sind noch offen, beispielsweise ob ein Zusammenhang zwischen TeamPCP und Megalodon besteht (abgesehen davon, dass beides raffinierte Lieferketten-Angriffe sind). Spoiler: Megalodon scheint eigenständig und unabhängig von TeamPCP zu sein. Weshalb betreffen diese Angriffe uns alle, es werden doch nur Konten und Repos von Entwickler/inne/n korrumpiert?

Aus zwei Gründen betrifft das uns alle:

https://www.pc-fluesterer.info/wordpress/2026/05/29/teampcp-war-gestern-auftritt-megalodon/

#Allgemein #Empfehlung #Hintergrund #Warnung #Website #foss #github #npm

#TeamPCP war gestern – Auftritt #Megalodon

TeamPCP hatte auf GitHub rund 3.800 Repositories kontaminiert. Jetzt kommt Megalodon und vergiftet auf Anhieb 5.561 Repos (Stand 2026-05-22). Damit erleben wir einen weiteren, noch größeren Lieferketten-Angriff als mit TeamPCP. Etliche Fragen sind noch offen, beispielsweise ob ein Zusammenhang zwischen TeamPCP und Megalodon besteht (abgesehen davon, dass beides raffinierte Lieferketten-Angriffe sind). Spoiler: Megalodon scheint eigenständig und unabhängig von TeamPCP zu sein. Weshalb betreffen diese Angriffe uns alle, es werden doch nur Konten und Repos von Entwickler/inne/n korrumpiert?

Aus zwei Gründen betrifft das uns alle:

https://www.pc-fluesterer.info/wordpress/2026/05/29/teampcp-war-gestern-auftritt-megalodon/

#Allgemein #Empfehlung #Hintergrund #Warnung #Website #foss #github #npm

https://winbuzzer.com/2026/05/26/megalodon-hit-5561-github-repos-through-malicious-workflows-xcxwbn/

Megalodon GitHub Actions Backdoor Campaign Hits 5,561 GitHub Repos

#Megalodon #GitHub #GitHubActions #Cybersecurity #Malware

https://winbuzzer.com/2026/05/26/megalodon-hit-5561-github-repos-through-malicious-workflows-xcxwbn/

Megalodon GitHub Actions Backdoor Campaign Hits 5,561 GitHub Repos

#Megalodon #GitHub #GitHubActions #Cybersecurity #Malware

RE: https://infosec.exchange/@cyberseckyle/116641588574197964

It should be noted that this "Megalodon" has nothing to do with the #Fediverse API project or the old pink Megalodon Fediverse App.

"On May 18, 2026, an automated campaign codenamed megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window. Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets to a C2 server at 216.126.225.129:8443." #Mastodon #MastoAdmin #Megalodon #Github
https://www.stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories

Fediverse Project:
https://github.com/h3poteto/megalodon

Old Pink App:https://github.com/sk22/megalodon

RE: https://infosec.exchange/@cyberseckyle/116641588574197964

It should be noted that this "Megalodon" has nothing to do with the #Fediverse API project or the old pink Megalodon Fediverse App.

"On May 18, 2026, an automated campaign codenamed megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window. Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets to a C2 server at 216.126.225.129:8443." #Mastodon #MastoAdmin #Megalodon #Github
https://www.stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories

Fediverse Project:
https://github.com/h3poteto/megalodon

Old Pink App:https://github.com/sk22/megalodon

Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli

https://insicurezzadigitale.com/megalodon-5-561-repository-github-compromessi-in-sei-ore-con-workflow-ci-cd-malevoli/

Megalodon: 5.561 repository GitHub compromessi in sei ore con workflow CI/CD malevoli

https://insicurezzadigitale.com/megalodon-5-561-repository-github-compromessi-in-sei-ore-con-workflow-ci-cd-malevoli/

So basically, all your CI/CD tokens are compromised if you pulled the poisoned version of Tiledesk, and it infects some of your other repos via CI/CD, but it ends there unless your stolen tokens sits around and is used to gain access to other things. But other than that, it doesn't continue to propagate does it?

#Megalodon #Malware #TileDesk

So basically, all your CI/CD tokens are compromised if you pulled the poisoned version of Tiledesk, and it infects some of your other repos via CI/CD, but it ends there unless your stolen tokens sits around and is used to gain access to other things. But other than that, it doesn't continue to propagate does it?

#Megalodon #Malware #TileDesk

So basically, all your CI/CD tokens are compromised if you pulled the poisoned version of Tiledesk, and it infects some of your other repos via CI/CD, but it ends there unless your stolen tokens sits around and is used to gain access to other things. But other than that, it doesn't continue to propagate does it?

#Megalodon #Malware #TileDesk

So basically, all your CI/CD tokens are compromised if you pulled the poisoned version of Tiledesk, and it infects some of your other repos via CI/CD, but it ends there unless your stolen tokens sits around and is used to gain access to other things. But other than that, it doesn't continue to propagate does it?

#Megalodon #Malware #TileDesk

So basically, all your CI/CD tokens are compromised if you pulled the poisoned version of Tiledesk, and it infects some of your other repos via CI/CD, but it ends there unless your stolen tokens sits around and is used to gain access to other things. But other than that, it doesn't continue to propagate does it?

#Megalodon #Malware #TileDesk

Can someone clarify how the #Megalodon malware spread?

So it initially came from #Tiledesk and anyone who pulled Tiledesk recently and caught the malware then caused it to spread further...?

I'm not entirely clear on how it spread to other repositories, but it seems tokens were stolen along the way. Is the trigger only when other people have a specific CI/CD workflow and push to main/master? A bunch of the infected repos don't have any other recent changes so I'm unclear on the spread.

Can someone clarify how the #Megalodon malware spread?

So it initially came from #Tiledesk and anyone who pulled Tiledesk recently and caught the malware then caused it to spread further...?

I'm not entirely clear on how it spread to other repositories, but it seems tokens were stolen along the way. Is the trigger only when other people have a specific CI/CD workflow and push to main/master? A bunch of the infected repos don't have any other recent changes so I'm unclear on the spread.

Can someone clarify how the #Megalodon malware spread?

So it initially came from #Tiledesk and anyone who pulled Tiledesk recently and caught the malware then caused it to spread further...?

I'm not entirely clear on how it spread to other repositories, but it seems tokens were stolen along the way. Is the trigger only when other people have a specific CI/CD workflow and push to main/master? A bunch of the infected repos don't have any other recent changes so I'm unclear on the spread.

Can someone clarify how the #Megalodon malware spread?

So it initially came from #Tiledesk and anyone who pulled Tiledesk recently and caught the malware then caused it to spread further...?

I'm not entirely clear on how it spread to other repositories, but it seems tokens were stolen along the way. Is the trigger only when other people have a specific CI/CD workflow and push to main/master? A bunch of the infected repos don't have any other recent changes so I'm unclear on the spread.

Can someone clarify how the #Megalodon malware spread?

So it initially came from #Tiledesk and anyone who pulled Tiledesk recently and caught the malware then caused it to spread further...?

I'm not entirely clear on how it spread to other repositories, but it seems tokens were stolen along the way. Is the trigger only when other people have a specific CI/CD workflow and push to main/master? A bunch of the infected repos don't have any other recent changes so I'm unclear on the spread.

RE: https://infosec.exchange/@jerry/116624419182616764

Heads up for anyone who uses Tiledesk chat.

#Megalodon #TileDesk #Malware

RE: https://infosec.exchange/@jerry/116624419182616764

Heads up for anyone who uses Tiledesk chat.

#Megalodon #TileDesk #Malware

RE: https://infosec.exchange/@jerry/116624419182616764

Heads up for anyone who uses Tiledesk chat.

#Megalodon #TileDesk #Malware

RE: https://infosec.exchange/@jerry/116624419182616764

Heads up for anyone who uses Tiledesk chat.

#Megalodon #TileDesk #Malware

RE: https://infosec.exchange/@jerry/116624419182616764

Heads up for anyone who uses Tiledesk chat.

#Megalodon #TileDesk #Malware

GitHub Repos Targeted in 5,500+ Malicious Commits

A shocking new campaign, dubbed Megalodon, has injected malware into over 5,500 GitHub repositories, putting sensitive credentials and tokens at risk of being stolen. This alarming attack highlights the growing threat of supply chain attacks, with experts warning that this could be just the beginning.

https://osintsights.com/github-repos-targeted-in-5500-malicious-commits?utm_source=mastodon&utm_medium=social

#SupplyChain #MaliciousCommits #CredentialstealingMalware #CicdPipeline #Megalodon

📢⚠️ Hackers targeted more than 5,500 #GitHub repositories in a massive “Megalodon” cyberattack that spread fake code updates and hidden backdoors in just 6 hours. Researchers warn developers to review recent changes and rotate cloud credentials immediately.

Read: https://hackread.com/github-repositories-megalodon-supply-chain-attack/

#CyberSecurity #Megalodon #Hacking #DataBreach #Developers

📢⚠️ Hackers targeted more than 5,500 #GitHub repositories in a massive “Megalodon” cyberattack that spread fake code updates and hidden backdoors in just 6 hours. Researchers warn developers to review recent changes and rotate cloud credentials immediately.

Read: https://hackread.com/github-repositories-megalodon-supply-chain-attack/

#CyberSecurity #Megalodon #Hacking #DataBreach #Developers

GitHub Megalodon Attack Targets Repos with Malicious CI/CD Workflows

In a shocking six-hour blitz on May 18, 2026, attackers unleashed a massive supply-chain campaign dubbed "Megalodon," pushing 5,718 malicious commits to 5,561 GitHub repositories. The sneaky assault mimicked routine CI maintenance, using fake author names and convincing commit messages to deceive victims.

https://osintsights.com/github-megalodon-attack-targets-repos-with-malicious-cicd-workflows?utm_source=mastodon&utm_medium=social

#Megalodon #Github #SupplyChain #Cicd #EmergingThreats

Megalodon: Mass GitHub Repo Backdooring via CI Workflows
#Megalodon
https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/

Megalodon: Mass GitHub Repo Backdooring via CI Workflows
#Megalodon
https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/