Mini Shai-Hulud
[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](https://attack.mitre.org/software/S9008), that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. [Mini… Source: MITRE ATT&CK
Activity on Jábega · 12 weeks
2 stories · first seen on 25 Sep 2026 · last seen on 26 Sep 2026
News
- GitHub Actions re-enabled with Mini Shai-Hulud payload still activeBleepingComputer · 26 Sep 2026
- Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud MalwareThe Hacker News · 25 Sep 2026
MITRE ATT&CK techniques
Initial Access
T1078.004Cloud Accounts 35 Sigma rulesT1195.001Compromise Software Dependencies and Development Tools 2 Sigma rules
Execution
T1053.006Systemd TimersT1059.006Python 10 Sigma rulesT1059.007JavaScript 26 Sigma rulesT1059.013Container CLI/APIT1559Inter-Process Communication 5 Sigma rulesT1609Container Administration Command 3 Sigma rulesT1677Poisoned Pipeline Execution
Persistence
T1205Traffic SignalingT1543.001Launch Agent 2 Sigma rulesT1543.002Systemd Service 3 Sigma rulesT1546Event Triggered Execution 62 Sigma rulesT1546.018Python Startup HooksT1554Compromise Host Software Binary 4 Sigma rules
Credential Access
T1003.007Proc FilesystemT1528Steal Application Access Token 13 Sigma rulesT1552.001Credentials In Files 20 Sigma rulesT1552.004Private Keys 6 Sigma rulesT1552.005Cloud Instance Metadata APIT1552.007Container API 3 Sigma rulesT1555.005Password Managers 1 Sigma rulesT1555.006Cloud Secrets Management StoresT1649Steal or Forge Authentication Certificates 4 Sigma rules
Discovery
T1016System Network Configuration Discovery 4 Sigma rulesT1033System Owner/User Discovery 26 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1087.004Cloud Account 2 Sigma rulesT1124System Time Discovery 1 Sigma rulesT1497Virtualization/Sandbox Evasion 3 Sigma rulesT1497.001System Checks 3 Sigma rulesT1614System Location Discovery 2 Sigma rulesT1614.001System Language Discovery 2 Sigma rules
Lateral Movement
Collection
T1119Automated Collection 5 Sigma rulesT1213.003Code Repositories 4 Sigma rulesT1560Archive Collected Data 11 Sigma rulesT1560.001Archive via Utility 10 Sigma rules
Command and Control
T1008Fallback Channels 4 Sigma rulesT1071.001Web Protocols 39 Sigma rulesT1090.003Multi-hop Proxy 3 Sigma rulesT1102.001Dead Drop Resolver 4 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1132.001Standard Encoding 4 Sigma rules
Exfiltration
T1041Exfiltration Over C2 Channel 4 Sigma rulesT1567.001Exfiltration to Code Repository 1 Sigma rules
Impact
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗