ThreatVectr
Tag

#Shai-Hulud

5 stories taggedShai-Hulud.

A computer workstation displaying cascading code and network diagrams in dim blue light, with forensic investigation equipment and documentation scattered acros
Threat Intelligence

Australian police arrest two alleged members of TeamPCP supply-chain crew

The pair, from Western Australia, are linked to a hacking collective that poisoned open-source software used by thousands of companies, and to the extortion crew Fulcrumsec.

4 min read
A developer's machine with folder structure expanding across the screen, credential stealer malware scanning through 469 different storage locations simultaneou
Identity & Access

Shai-Hulud Worm Now Hunts 469 Places for Developer Secrets

A self-spreading credential thief has more than doubled the hiding spots it checks on developer machines, from 189 to 469.

4 min read
Police vehicles and law enforcement activity outside a technology-related facility in Western Australia, with digital security imagery on nearby screens
Threat Intelligence

Australian Police Arrest Two Alleged Members of Supply-Chain Extortion Crew TeamPCP

The Western Australia arrests target a group blamed for a year-long run of open-source software attacks, including the Shai-Hulud worm that hit thousands of companies.

4 min read
Cybersecurity incident timeline chart on a large monitor showing the LiteLLM package compromise alongside the separate Trivy scanner vulnerability, with data da
Threat Intelligence

Most of the 2,500 organisations hit in the LiteLLM attack were actually victims of a different breach entirely

A closer look at the data shows the Trivy scanner compromise, not the LiteLLM package, caused almost all the damage, and stolen credentials are already on sale.

4 min read
Illustration for the story: Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages
Threat Intelligence

Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages

The self-propagating supply chain campaign tied to Miasma and Hades has spread again, abusing GitHub Actions workflows and now reaching Go modules.

3 min read
© 2026 Threat Vectr