Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
Socket reports that actions-cool/issues-helper and actions-cool/maintain-one-comment, compromised on May 18, 2026 in the Mini Shai-Hulud campaign, became accessible again on September 16. Their release tags still pointed at malicious content, so workflows referencing those tags resumed downloading a payload that harvested CI/CD credentials and exfiltrated them to an attacker-controlled server tied to t.m-kosche[.]com. GitHub Staff has disabled both repositories again. Workflows pinned to a full commit SHA from before May 18 were not affected; Socket advises removing the actions, rotating secrets, and reviewing runs after September 16.
- actions-cool/issues-helper and maintain-one-comment were compromised on May 18, 2026.
- Repositories became accessible again on September 16 with malicious release tags intact.
- Workflows using version tags resumed downloading and executing the payload.
- Payload harvested CI/CD credentials and sent them to an attacker server.
- Pinning a pre-May 18 commit SHA avoids the reactivated tags.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Vendors
- GitHub
- Products
- GitHub Actions
- Threat actors
- Mini Shai-Hulud
- Malware
- Mini Shai-Hulud
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | m-kosche.com | ity cluster, citing overlaps in the exfiltration domain ("t.m-kosche[.]com") used in the GitHub Actions workflows and the npm packag |
From the original article
3 min read at thehackernews.com
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.