Attackers abuse enterprise AI tools for theft, C2, and agent hijacking
A fake Postmark MCP package siphoned mail after 15 clean versions, and SesameOp hid C2 in the OpenAI Assistants API.
52
Malware
Shai-Hulud
- Mentions · 7d3
- Mentions · 30d17
- All mentions27
- First seenAug 11, 2026
- Last mentioned3d ago
Timeline
27 articles · newest firstAttackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
SBOMs missed scope of a Shai-Hulud supply-chain compromise
A stale SBOM called a SaaS environment clean while a hidden transitive dependency had already run.
52
Exaforce says GitHub token theft and vishing drain data in minutes
A dormant OAuth token pulled 472 of 638 repositories; ClickFix and help-desk vishing followed the same pattern.
36
Paper: building from source stops most npm and PyPI malware
A source check blocked 87.7 to 99.9 percent of 47,066 malicious packages, depending on how strictly the source was vetted.
52
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Round 118 collects reports on ClingSTUN, npm supply-chain theft, AhsayCBS exploitation, and other malware campaigns.
36
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Shai-Hulud infected Tensorlake’s npm SDK 0.5.144, stealing credentials before the package was removed within minutes.
78
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
Malicious tensorlake@0.5.144 on npm delivers a Shai-Hulud worm that steals developer secrets and can wipe hosts.
82
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.
77
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
73
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
78
The Credential Layer Is Expanding Faster Than Security Teams Can See It
GitGuardian says secrets sprawl is outpacing visibility as commits, agents, and leaked AI credentials multiply.
36
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
58
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
76
Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
Qualys says supply-chain malware on developer machines is stealing cloud credentials and enabling downstream breaches.
72
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
73
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
62
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
22
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.
68
Threat actors are giving AI agents a bigger role in cyberattacks
Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.
62
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
55
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
40
Two alleged TeamPCP hackers arrested over global supply chain attacks
AFP and FBI arrested two alleged TeamPCP hackers behind open-source supply chain attacks that stole 500,000+ credentials from 1,000+ organizations.
78
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
68
Related CVEs
by mentions- CVE-2026-2525332%8.8One-Click WebSocket Token Leak Enabling RCE in OpenClaw (Moltbot/Clawdbot)
- CVE-2025-327117%7.5Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network
Appears with
- npmproduct · 17
- GitHubvendor · 10
- ChainDropmalware · 6
- TeamPCPthreat actor · 6
- GitHub Actionsproduct · 5
- Claudeai model · 5
- GitHuborganization · 5
- Mini Shai-Huludmalware · 5
- PyPIproduct · 4
- Tensorlakevendor · 4
- Tensorlakeorganization · 4
- Microsoftvendor · 4
- Claude Codeproduct · 4
- Geminiai model · 4
- Socketorganization · 3
- GitGuardianvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.