The Hades Campaign: Malware That Deceives AI Security Systems
A sophisticated supply chain attack exploits AI analysis, targeting Python environments with silent payloads.
Threat actors continue to target software supply chains with the newly discovered Hades Campaign. This sophisticated attack compromises Python developer environments, activating as soon as infected packages are imported. It utilizes the Bun toolkit to execute multi-layer payloads, extracting sensitive data and exploiting common security frameworks, including AI systems through adversarial prompt injection.
StepSecurity researchers discovered Hades, an evolution of the Miasma threat actor. Previously, Miasma deployed self-replicating worms for multi-cloud credential sweeps and exploited Linux memory. Hades continues these methods, targeting key packages like ensmallen, mflux-streamlit, and nhmpy.
The campaign's entry point is an obfuscated script in a Python package's __init__.py file. Once inside, it drops a Bun runtime binary, executing JavaScript payloads that scrape Linux memory and introduce tailored memory scrapers for macOS and Windows.
A notable feature is its ability to bypass LLMs that scan for suspicious code. By embedding a simple text block, it persuades the AI to ignore the hidden malicious code, classifying the package as safe. This represents a significant shift, with attackers exploiting AI systems' cognitive logic.
Hades also uses public GitHub infrastructure for command and control (C2) operations, blending malicious traffic with normal one. Stolen credentials are encrypted and pushed to GitHub repositories labeled "Hades — The End for the Damned."
The malware exploits security mechanisms like SSH, SCP, and OIDC. When running in GitHub Actions, it bypasses registry policies, generates SLSA provenance bundles, and publishes compromised packages to PyPI and npm. If it finds GitHub tokens with write permissions, it extracts secrets directly from the runner’s address space.
Persistence is established by monitoring for stolen token presence. If revoked, it triggers a wiper process to erase user files. The campaign underscores the evolving threat landscape, highlighting vulnerabilities in AI-driven security.
