Palo Alto Unit 42 Shai-Hulud November 2025

Shai-Hulud has masqueraded as a legitimate Bun installer.

Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.

Shai-Hulud has leveraged compromised accounts to log into cloud services to access cloud hosted repositories.

Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder. Shai-Hulud has also utilized the `shred` command on Linux devices.

Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.

Shai-Hulud has inserted a new lifecycle hook to include `postinstall`. Shai-Hulud has also leveraged the NPM lifecycle hook `preinstall`.

Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys. Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`. Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets. Shai-Hulud has also posted stolen credentials to public GitHub repositories.

Shai-Hulud has also leveraged GitHub actions from stolen accounts in order to create a malicious Github workflow within `.github/workflows/discussion.yaml`.

Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.