Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems

The Shai-hulud 2.0 campaign is a sophisticated malware targeting cloud and developer ecosystems, capable of stealing credentials from major cloud platforms and automating the backdooring of NPM packages. Key points include: 1) It continues credential theft from cloud services and introduces backdoor capabilities for NPM packages, creating a wormable threat. 2) The malware can access cloud-native secret management services and has destructive capabilities to wipe user data if data harvesting fails.

3) It automates the backdooring of NPM packages, republishing them with malicious payloads, potentially impacting thousands of users. 4) The malware uses advanced techniques to ensure stealthy propagation and evade detection, including creating GitHub Actions workflows for command-and-control operations. 5) Trend Vision One™ provides detection and blocking of the malware's indicators of compromise, along with tailored threat insights and intelligence reports.