GitHub Actions Became a Secret-Stealing Conveyor Belt
A malicious workflow commit in GitHub Actions is not a repo-only problem. It can turn CI into a credential siphon that pulls stored secrets, short-lived runner environment data, cloud metadata credentials, SSH keys, and OIDC tokens that reach other cloud and SaaS systems after the repo itself is patched.
Researchers say Megalodon pushed 5,718 malicious commits into 5,561 repositories in six hours, using forged CI-style identities and workflow payloads to exfiltrate data at scale. The harvested material included AWS, Google Cloud, and Azure instance credentials, Vault and Terraform tokens, GitHub Actions OIDC tokens, and multiple classes of API and deployment secrets.
The risk persists beyond secret rotation. If the workflow touched cloud metadata or federated identity, the attacker may already have valid access outside GitHub, and standard secret-scanning can miss that pivot.