MITRE ATT&CKsoftware (malware)
S9008 Shai-Hulud
- Domain
- enterprise
- Platforms
- Linux, SaaS, Windows
- Version
- 1.0
- Created
- 2026-04-09
Description
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.
Related
Uses · MITRE ATT&CK (33)
- T1685 Disable or Modify Tools technique
- T1678 Delay Execution technique
- T1677 Poisoned Pipeline Execution technique
- T1036.009 Break Process Trees sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1567.004 Exfiltration Over Webhook sub-technique
- T1546.016 Installer Packages sub-technique
- T1593.003 Code Repositories sub-technique
- T1213.003 Code Repositories sub-technique
- T1608.001 Upload Malware sub-technique
- T1059.007 JavaScript sub-technique
- T1071.001 Web Protocols sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1059.001 PowerShell sub-technique
- T1059.004 Unix Shell sub-technique
- T1567.001 Exfiltration to Code Repository sub-technique
- T1552.005 Cloud Instance Metadata API sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553 Subvert Trust Controls technique
- T1552.001 Credentials In Files sub-technique
- T1548.003 Sudo and Sudo Caching sub-technique
- T1550.001 Application Access Token sub-technique
- T1543.002 Systemd Service sub-technique
- T1528 Steal Application Access Token technique
- T1485 Data Destruction technique
- T1027 Obfuscated Files or Information technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
References
- https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again Aikido Shai-Hulud September 2025
- https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed Netskope Shai-Hulud November 2025
- https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ Palo Alto Unit 42 Shai-Hulud November 2025
- https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack Wiz Shai-Hulud September 2025
- https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/ Microsoft Shai-Hulud December 2025
- https://socket.dev/blog/shai-hulud-strikes-again-v2 Socket Shai-Hulud November 2025
- https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages Socket Shai-Hulud Trufflehog September 2025