highMalware
Shai-Hulud Infostealer Worm Expands Scanning to 469 Credential Locations Across Developer Environments
GitGuardian researchers have identified a new variant of the Shai-Hulud infostealer worm that has expanded its credential scanning capability from 189 to 469 locations. The variant targets developer environments, CI/CD tooling, cloud configurations, and AI tool configurations, significantly broadening the attack surface for credential theft. The findings were published in early August 2026 and covered by The Hacker News on September 3, 2026.
The Hacker News2 min read