← All threat actors
Shai-Huludmalware / toolS9008 ↗
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages.
Reports / IOCs (VT)
365 reports · 134 IOCs
Reported activity
2025 – 2026
CVEs seen in reporting
ATT&CK techniques in reports
- T1078 Valid Accounts3
- T1552.001 Credentials In Files3
- T1195.002 Compromise Software Supply Chain3
- T1552.005 Cloud Instance Metadata API3
- T1195.001 Compromise Software Dependencies and Development Tools3
- T1041 Exfiltration Over C2 Channel2
- T1555 Credentials from Password Stores2
- T1078.004 Cloud Accounts2
- T1526 Cloud Service Discovery2
- T1530 Data from Cloud Storage2
- T1059.004 Unix Shell2
- T1005 Data from Local System1
- T1027 Obfuscated Files or Information1
- T1048 Exfiltration Over Alternative Protocol1
- T1059 Command and Scripting Interpreter1
- T1071.001 Web Protocols1
- T1195 Supply Chain Compromise1
- T1547 Boot or Logon Autostart Execution1
- T1098 Account Manipulation1
- T1496 Resource Hijacking1