Mini Shai-Hulud is a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, that has been used by TeamPCP to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. Mini Shai-Hulud can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. Mini Shai-Hulud also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.[1][2][3][4][5][6]
55
TechniquesTop 1%
12
TacticsTop 1%
1
Threat groupunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Mini Shai-Hulud has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.7
Mini Shai-Hulud has used a hybrid AES-256-GCM and RSA OAEP-SHA256 encryption to archive gathered data. Mini Shai-Hulud has also utilized custom MD5-keystream XOR cipher to encrypt data.14Mini Shai-Hulud has also been deployed via an obfuscated script using Bun JavaScript runtime.15
Mini Shai-Hulud has leveraged commands such as whoami to identify the system owner.16
Discovery47 detection rules
Standing S9043
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques55Top 1%
99th percentile · 99% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
Tactics12Top 1%
100th percentile · None of the 825 ATT&CK software entries has more tactics spanned — the highest in the population.
Threat group161% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique6medBottom 8%
8th percentile · 92% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique3medBottom 16%
16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.
Data comps / technique4med54% tie · 11 values
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique2medTop 9%
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 55 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
2017-11-10
2022-12-02
0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-02
—
0055ad1f-be85-4798-83cf-a6da17c993b3
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)
Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.
The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. (...)