Recorded Future says AI mostly accelerates familiar cyberattacks
Of 103 incidents, 32 used AI in malware or operations, including one Taiwan campaign with up to eight agents.
1
Stories per day · 30 days
3 RSS
Relatedsupply-chain6infostealer2npm2prompt-injection2agent-hijacking1ai-agents1ai-malware1ci-cd1copilot1credential-abuse1credential-theft1developer-tools1github1mcp1mfa1miasma1recorded-future1rubygems1
24 stories, newest first · one card per story
Stories tagged #shai-hulud
Malicious Ruby gem strutil-core installs a credential-stealing worm
Socket found no public dependents and confirmed no victims; RubyGems removed both versions within about five hours.
1
Attackers abuse enterprise AI tools for theft, C2, and agent hijacking
A fake Postmark MCP package siphoned mail after 15 clean versions, and SesameOp hid C2 in the OpenAI Assistants API.
2
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
SBOMs missed scope of a Shai-Hulud supply-chain compromise
A stale SBOM called a SaaS environment clean while a hidden transitive dependency had already run.
1
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
7
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Shai-Hulud infected Tensorlake’s npm SDK 0.5.144, stealing credentials before the package was removed within minutes.
3
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
Malicious tensorlake@0.5.144 on npm delivers a Shai-Hulud worm that steals developer secrets and can wipe hosts.
9
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.
7
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
3
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
8
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
1
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
8
Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
Qualys says supply-chain malware on developer machines is stealing cloud credentials and enabling downstream breaches.
2
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
2
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
2
An undercover Google analyst infiltrated a notorious supply-chain hacking gang
Google's Mandiant planted an undercover analyst inside TeamPCP, the supply-chain gang that breached 1,000+ companies via poisoned open-source packages before two Australian arrests.
An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
Google revealed a Mandiant undercover analyst infiltrated TeamPCP, letting it warn hundreds of victims and disrupt the gang's supply chain attacks and extortion.
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
2
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
2
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
3
Australian cops cuff alleged TeamPCP masterminds
Australian police, with FBI assistance, arrested the alleged masterminds behind the Shai-Hulud worm and related supply chain attacks.
Two alleged TeamPCP hackers arrested over global supply chain attacks
AFP and FBI arrested two alleged TeamPCP hackers behind open-source supply chain attacks that stole 500,000+ credentials from 1,000+ organizations.
1
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.