Megalodon Supply Chain Attack Hit 5,561 GitHub Repos: Your Monday Intel Rundown

TeamPCP is a financially and geopolitically motivated threat actor previously attributed to the TanStack npm supply chain worm that spread across 4,500 npm packages in early May 2026. Megalodon represents a significant escalation in scope and speed, five times larger than the TanStack campaign, executed in half the time.

The attack chain began with infostealer infections on developer machines. Infostealers, malware that harvests browser-stored credentials, credential manager secrets, and developer environment files, provided TeamPCP with working GitHub personal access tokens for thousands of developer accounts. Those stolen tokens gave the attacker push access to repositories, allowing malicious commits to be authenticated as legitimate developer activity.

To avoid detection, TeamPCP used throwaway accounts with randomized eight-character usernames and rotated through four author identities, build-bot, auto-ci, ci-bot, and pipeline-bot, paired with seven commit message variants designed to look like routine CI maintenance: messages referencing workflow dependency updates and runner configuration fixes.

The malicious commits injected a backdoored workflow YAML file into each repository's .github/workflows/ directory. Upon any CI trigger, a push, a pull request merge, a scheduled job, the workflow executed a base64-encoded bash payload that called env to enumerate all available environment variables, then targeted patterns matching cloud credentials and secrets: TOKEN, KEY, SECRET, AWS, AZURE, GCP, SSH_*. All captured secrets were transmitted over HTTPS to 216.126.225.129:8443.

GitHub detected the campaign and began removing malicious workflows within hours of the attack window closing on May 18. Any repository that cannot be confirmed free of malicious workflow execution during the 11:36–17:48 UTC window should be treated as compromised.

MiniPlasma is a Windows local privilege escalation zero-day whose public proof-of-concept was released in May 2026, giving any attacker with a local foothold on a Windows system a reliable path to SYSTEM-level execution on fully patched machines. No Microsoft patch is available as of May 25, 2026.

The vulnerability is distinct from the BlueHammer and RedSun LPEs disclosed in April 2026. MiniPlasma exploits a different code path in Windows kernel or privilege management subsystems to achieve SYSTEM execution. Independent researchers have verified the PoC works on current builds of Windows 10, Windows 11, and Windows Server. The public release means commodity threat actors, not just sophisticated APTs, now have a working local escalation tool requiring no special conditions on fully patched Windows endpoints.

For defenders, MiniPlasma follows a now-familiar 2026 pattern: a researcher discloses a Windows LPE PoC publicly before Microsoft has prepared a patch, handing criminal groups a free privilege escalation capability. The gap between PoC publication and Microsoft patch release typically spans weeks, not days. Threat actors have historically begun weaponizing publicly released PoCs within 24 to 72 hours.

Compensating controls while awaiting a patch: enforce strict least-privilege on all Windows endpoints and restrict who can obtain local interactive or RDP sessions. Deploy behavioral detections in your SIEM for anomalous SYSTEM-level process spawning, especially from processes that should never run at elevated privilege. Alert on unexpected parent-child process relationships involving lsass.exe, winlogon.exe, and services.exe. Monitor Microsoft Security Response Center (MSRC) advisories and treat MiniPlasma as an emergency change-window item the moment a fix is released.

Microsoft's May 2026 Patch Tuesday, released May 13, addressed 120 vulnerabilities across Windows, Microsoft 365, Azure services, and developer tooling. Seventeen vulnerabilities are rated Critical, 103 are rated Important, and 13 carry a Microsoft assessment of Exploitation More Likely, meaning security teams should expect active weaponization within 30 days.

CVE-2026-41089 is a Windows Netlogon stack-based buffer overflow rated CVSS 9.8. An unauthenticated attacker can exploit this remotely to achieve code execution on a domain controller. Netlogon is a foundational Windows authentication service, a successful exploit on a domain controller constitutes full domain compromise. Patch this before any other item on this list.

CVE-2026-41096 is a heap overflow in the Windows DNS Client. An attacker-controlled DNS server can send a specially crafted response to trigger remote code execution on any Windows machine that resolves DNS queries through the attacker-controlled server. All Windows deployments are in scope. This is particularly relevant for organizations that rely on public DNS resolvers without DNS-over-HTTPS.

CVE-2026-35421 is a Windows GDI Remote Code Execution vulnerability exploitable by opening a malicious Enhanced Metafile (EMF) file via Microsoft Paint. Phishing campaigns delivering EMF attachments can trigger this without any user interaction beyond opening the file.

Four Microsoft Office and Word RCE flaws, CVE-2026-40361, CVE-2026-40367, CVE-2026-40366, and CVE-2026-40364, are all rated Critical and exploitable via malicious file attachments. With Office present in virtually every enterprise environment and phishing as the dominant initial access vector, these require same-day patching. Run winget upgrade --all or push updates via WSUS or Intune on domain controllers first.

Two actively exploited Microsoft Defender vulnerabilities reached CISA's Known Exploited Vulnerabilities catalog on May 21, 2026, with a June 3 federal remediation deadline. Both are confirmed exploited in the wild, making them immediately actionable for every organization regardless of federal status.

CVE-2026-41091 is a local privilege escalation flaw in the Microsoft Malware Protection Engine version 1.26030.3008. The vulnerability stems from improperly resolved symbolic links before file access operations, allowing an attacker who has obtained a local foothold to escalate directly to SYSTEM-level privileges. The patched version is engine v1.1.26040.8. A third related vulnerability, CVE-2026-45584, enables Remote Code Execution in the same engine version, compounding the severity.

CVE-2026-45498 is a denial of service vulnerability in the Microsoft Defender Antimalware Platform. Successful exploitation prevents Defender from functioning, creating a detection-blind window during which the attacker can operate without triggering any endpoint alerts. The fix is Antimalware Platform version v4.18.26040.7.

The combined operational impact is damaging: CVE-2026-45498 disables Defender, then CVE-2026-41091 achieves SYSTEM privilege with no endpoint security running. Attackers who successfully chain these two vulnerabilities have a clean escalation path on any Windows endpoint running an unpatched Defender version.

Microsoft Defender typically auto-updates through Windows Update, but update delivery can be delayed, throttled, or disabled in air-gapped and restricted network environments. To verify the current engine version on a Windows endpoint, run Get-MpComputerStatus in PowerShell and compare the AMEngineVersion and AMProductVersion fields against the patched versions above. Confirm deployment on all endpoints before June 3.

Threat actors are conducting automated credential brute-forcing against SonicWall Gen6 SSL-VPN appliances and bypassing multi-factor authentication controls to deploy ransomware payloads across enterprise networks. SonicWall Gen6 devices, including NSa, TZ, and SOHO series running older SonicOS firmware builds, are the primary targets of the current campaign.

The attack pattern is straightforward. Automated tools attempt credential stuffing against the Gen6 SSL-VPN web interface using credential lists sourced from previous breaches and infostealer dumps. Once a valid credential is identified, session management weaknesses in the older firmware allow attackers to bypass MFA enrollment or session validation, gaining full VPN access with legitimate user credentials. From inside the VPN, attackers conduct standard Active Directory enumeration and deploy ransomware through Group Policy Objects or remote execution tools such as PsExec and WMI.

SonicWall Gen6 devices have been targeted by attackers since 2024 through multiple known vulnerabilities. SonicWall published firmware advisories for Gen6 SSL-VPN in both 2024 and 2025 recommending urgent patching. The current ransomware campaign represents the predictable consequence for organizations that have not applied those updates.

Immediate actions for SonicWall Gen6 operators: upgrade to the latest firmware for your specific device series before end of week. Restrict SSL-VPN access to known source IP ranges using geo-blocking and allowlist policies. Enable login attempt rate limiting and alert on brute-force patterns exceeding five failed attempts per minute. Verify MFA enforcement is active post-firmware upgrade, some updates reset MFA configuration to default values. If Gen6 migration has not been planned, begin a Gen7 upgrade assessment now given the accumulating vulnerability surface on end-of-extended-support hardware.

This week requires five concurrent action tracks. Sequence by exposure first, highest-blast-radius threats get same-day attention regardless of patching complexity.

Megalodon takes the top slot for any organization using GitHub-hosted open source dependencies. Audit GitHub Actions workflow files across all repositories for the May 18 attack window (11:36–17:48 UTC). Check commits from randomized eight-character usernames or build-bot, auto-ci, ci-bot, and pipeline-bot author identities. Block 216.126.225.129 at the network perimeter and DNS layer now. Rotate all CI secrets, cloud credentials, and SSH keys for any repository that cannot be confirmed unaffected.

For May Patch Tuesday critical items: domain controllers get CVE-2026-41089 (Windows Netlogon, CVSS 9.8) and CVE-2026-41096 (Windows DNS Client) patches first, then push Office and Word RCE fixes to all endpoints before end of business.

For Microsoft Defender: run Get-MpComputerStatus across all Windows endpoints. Any machine running Malware Protection Engine below v1.1.26040.8 or Antimalware Platform below v4.18.26040.7 is exposed to confirmed in-the-wild exploitation. Force an update cycle via Windows Update or SCCM before June 3.

For MiniPlasma: no patch exists. Deploy behavioral SIEM detections for SYSTEM-level privilege escalation from non-standard parent processes and restrict all local and RDP access to verified users while awaiting a Microsoft fix.

For SonicWall Gen6: update firmware on all SSL-VPN appliances before weekend. Verify MFA is active post-update and restrict source IPs at the VPN gateway.