Mini Shai-Hulud

☆ pin

Also known as mini Shai-Hulud, Miasma, Hades

Reports

First seen

Apr 29, 2026

Last seen

Sep 26, 2026

Motivation

Financial

Targeting

Sectors

Technology ×3

Top ATT&CK techniques

T1195 Supply Chain Compromise ×5T1041 Exfiltration Over C2 Channel ×5T1555 Credentials from Password Stores ×4T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×2T1204 User Execution ×1T1547.014 Browser Extensions ×1T1078 Valid Accounts ×1T1059.007 JavaScript ×1T1003 OS Credential Dumping ×1T1005 Data from Local System ×1T1059 Command and Scripting Interpreter ×1T1087 Account Discovery ×1

Indicators

domain ×2filename ×1

Indicator values are available on Pro and via the API.

Recent reports

High

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Bleeping ComputerSep 26, 2026 High

Compromised GitHub Actions Resumed Executing Mini Shai-Hulud Malware After Re-enablement

The Hacker NewsSep 25, 2026 High

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

The Hacker NewsJun 26, 2026 Critical

Popular GitHub Actions Compromised via Imposter Commits to Steal CI/CD Credentials

The Hacker NewsMay 19, 2026 High

'Mini Shai-Hulud' supply chain attack targets SAP npm packages

Sophos NewsApr 29, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.