Microsoft Shai-Hulud December 2025

Shai-Hulud has utilized PowerShell `Invoke-WebRequest` to download and install the malicious payload.

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.

Shai-Hulud has utilized curl to install Bun over HTTPS.

Shai-Hulud has leveraged compromised accounts to log into cloud services to access cloud hosted repositories.

Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.

Shai-Hulud has downloaded packages from code repositories. Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.

Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.

Shai-Hulud has published itself on compromised code repository maintainers within infected packages in attempts to propagate to other victims. Shai-Hulud has also modified versions of code packages.

Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder. Shai-Hulud has also utilized the `shred` command on Linux devices.

Shai-Hulud has inserted a new lifecycle hook to include `postinstall`. Shai-Hulud has also leveraged the NPM lifecycle hook `preinstall`.

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets. Shai-Hulud has also posted stolen credentials to public GitHub repositories.

Shai-Hulud has the ability to search open sites and code repositories for compromised credentials. Shai-Hulud has discovered packages associated with compromised accounts. Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.