Shai-Hulud Worm Now Hunts 469 Places for Developer Secrets
A self-spreading credential thief has more than doubled the hiding spots it checks on developer machines, from 189 to 469.
Key points - GitGuardian researchers reported in early August that a new variant of the Shai-Hulud worm scans 469 locations for credentials, up from 189 in earlier versions. - The worm is an infostealer, meaning software built to quietly copy passwords and tokens off a machine. - New scan targets include developer tools, cloud settings, build systems, and configuration files for AI assistants. - The jump in scanned paths shows attackers are following developers into every new tool they adopt. - Anyone writing code or managing cloud accounts should assume secrets stored in plain files are a target.
A nasty piece of software that steals developer passwords has grown teeth. Researchers at GitGuardian say the latest version of the Shai-Hulud worm now looks in 469 different places on a computer for secrets it can steal. The previous version checked 189. We first covered the worm on 2 June 2026; the arrests of two alleged members of the supply-chain crew blamed for deploying it are detailed in our 27 August report.
A worm is a program that copies itself from one machine or account to the next without anyone clicking anything. An infostealer scoops up credentials and the digital keys that let apps talk to each other.
Shai-Hulud does both jobs at once. It rummages through a developer's computer, grabs whatever credentials it finds, then uses those credentials to spread further.
What is the worm actually looking for?
Small text files where developers save their passwords and access keys, often out of convenience. Those files sit in predictable folders, and the new variant knows about far more of those folders than its predecessor did.
The 469 locations, as reported by The Hacker News, cover four broad areas of a modern developer's setup.
| Area scanned | What lives there |
|---|---|
| Developer tools | Login tokens for code hosting and package managers |
| CI/CD systems | Keys used by automated build and deploy pipelines |
| Cloud configs | Credentials for Amazon, Google and Microsoft cloud accounts |
| AI tool configs | API keys for assistants like ChatGPT and Claude |
CI/CD stands for continuous integration and continuous deployment: the conveyor belt that takes code a developer writes and automatically tests then deploys it live to customers. That conveyor belt needs powerful keys to do its job, which makes it a rich target.
Why does the jump from 189 to 469 matter?
Every time developers adopt a new tool, that tool starts storing a fresh set of secrets on the machine, and the worm's authors keep their shopping list current.
The inclusion of AI tool configuration files is the tell. A year ago, almost nobody had an API key for an AI assistant sitting in a hidden folder on their laptop. Plenty of developers do now. An API key is a long string of characters that acts like a password for one piece of software talking to another: steal it, and you can run up someone else's bill or read data they never meant to share.
Would multi-factor authentication have helped?
Honestly, only in part. Multi-factor authentication, where you approve a login with a phone prompt or a hardware key, protects the moment someone tries to sign in. It doesn't protect a token already sitting in a file on a compromised machine. Once the worm reads that token, it can often use it directly without triggering a fresh login.
The fix is less glamorous: stop storing long-lived secrets in plain files. Use short-lived tokens that expire in minutes. Keep credentials in a dedicated secrets manager rather than a config file in your home directory. Rotate anything that might have been exposed.
What should ordinary developers do this week?
Check the folders where tools like the AWS command line and GitHub CLI keep their config. Rotate any key you haven't touched in months, then move it into a secrets manager if your employer offers one. Small housekeeping, real payoff.
The broader picture here is that stolen credentials are increasingly commoditised: our 14 August story on the LiteLLM breach found harvested keys already on sale within days of that compromise. Shai-Hulud is one more mechanism feeding the same market.
