Shai-Hulud Infostealer Expands Credential Harvesting to 469 Locations

Shai-Hulud infostealer malware now scans 469 credential locations across developer environments, CI/CD tools, and cloud configurations, highlighting escalating supply chain security risks. The expansion underscores the critical need to secure credentials as attackers exploit trusted relationships in software ecosystems.

In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 locations across developer environments, Continuous Integration/Continuous Deployment (CI/CD) tooling, cloud configurations, and even AI tool configs.

Earlier variants of the infostealer worm only checked 189 paths. The jump says a lot. Attackers have

Read original article