Indicators of compromise · Shai-Hulud — 2 shown
25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5efb50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Shai-Hulud Infostealer Expands to 469 Credential Locations
Incident note — 3 September 2026
On 3 September 2026, GitGuardian reported that a recent variant of the Shai-Hulud infostealer worm has significantly expanded its credential-hunting scope. The variant now scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations and AI tool configuration files — up from the previous 189 paths.
Coverage shifts are notable: Linux locations have risen from 89 to 290, reflecting a deliberate expansion beyond its historical focus. New cloud targets include Hetzner, Alibaba Cloud and Tencent Cloud, broadening the tool's applicability to providers popular outside the traditional Western cloud fleet.
Given the worm's self-propagating nature and its focus on developer and CI/CD systems, the credential theft risk to technology supply chains is significant, including for Australian development teams who use the affected cloud and AI tooling.