Mini Shai-Hulud

Also known as Miasma, Hades

Reports

First seen

Apr 29

Last seen

Jun 26

Motivation

credential theft, supply chain compromis

Targeting

Sectors

technology ×1

Top ATT&CK techniques

T1195 Supply Chain Compromise ×3T1041 Exfiltration Over C2 Channel ×3T1555 Credentials from Password Stores ×3T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×2T1547.014 Browser Extensions ×1T1078 Valid Accounts ×1T1005 Data from Local System ×1T1059 Command and Scripting Interpreter ×1T1547 Boot or Logon Autostart Execution ×1T1136 Create Account ×1T1040 Network Sniffing ×1T1059.007 JavaScript ×1

Indicators

domain ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

The Hacker NewsJun 26 Critical

Popular GitHub Actions Compromised via Imposter Commits to Steal CI/CD Credentials

The Hacker NewsMay 19 High

'Mini Shai-Hulud' supply chain attack targets SAP npm packages

Sophos NewsApr 29

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.