Nietzsche Virus Lab

macOS / linux malware research and red teaming stuff

[Socket @SocketSecurity]

🚨 Mini Shai-Hulud/Miasma has now spread to PyPI.

Socket found 37 malicious artifacts across 19 PyPI packages.

The packages abuse #Python .pth startup behavior to launch a Bun-powered credential stealer targeting developer, cloud, and CI/CD secrets.

https://t.co/tYhmMqvjyw

[Adnan Khan @adnanthekhan]

It appears miasma has made it back to @Microsoft.

https://t.co/SZTKQHQ4cV

https://t.co/znVviIX8JI

[Andre Gironda @AndreGironda]

Mac stealer SHub Reaper is spoofing Apple, Google, and Microsoft -- https://t.co/Q4d45iE2AK

[Aikido Security @AikidoSecurity]

🚨 Miasma, the supply chain campaign that previously compromised 32 @RedHat packages, is spreading again with a new wave targeting the npm ecosystem.

Targets include:
- vapi-ai/server-sdk (71k weekly downloads)
- ai-sdk-ollama (31k weekly downloads)

No postinstall scripts were used. Attackers are hiding execution inside binding.gyp, exploiting node-gyp to run malware silently on install.

[Moshe Siman Tov Bustan @MosheTov]

I really need to get some sleep - but seeing a malware embedding it's own ebpf script inside it's packed code in order to dump and deploy it on the machine -> is some next lvl stuff...

Great work from JFrog for finding this

[StepSecurity @step_security]

🚨 Breaking: npm supply chain worm spreading via binding.gyp, bypassing install hook detection. Steals npm/GitHub/AWS/GCP/Azure credentials and publishes poisoned versions of packages you maintain. Actively investigating. Affected packages and analysis: https://t.co/GSiB78fviq

[abhisek @abh1sek]

Here's an example:
https://t.co/PDLDc9Tgj2

[JFrog Security @JFrogSecurity]

The software supply chain has a new predator. 🐛

Meet Iron Worm, the "rustier cousin" of the infamous Shai-Hulud worm. Just like its predecessor, it burrows into dev environments, steals credentials, and self-propagates through trusted GitHub and npm workflows.
Except this one is built in heavy, async Rust, hides behind an eBPF kernel rootkit, and talks over Tor.

Full teardown of the beast:
https://t.co/9Tn4G8tluW

[OX Security @OX__Security]

Shai-Hulud is getting more sophisticated 🧐🎩

we uncovered a 6-stage malware chain that uses GitHub as a live update mechanism — allowing attackers to continuously evolve payloads and evade disruption.

OUR FULL RESEARCH: https://t.co/No9dlqzDgz

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has published an analysis of the npm supply chain compromise affecting 32 maliciously modified packages across >90 versions under the redhat-cloud-services npm scope and leading to credential theft and compromise of addt'l maintainer packages: https://t.co/CpFa3iDGL0

[Microsoft Threat Intelligence @MsftSecIntel]

Compromised npm packages ([email protected], [email protected]) are abusing Hugging Face repos as exfiltration infrastructure. The packages deploy a remote access trojan (RAT) that captures keystrokes, screenshots, and crypto wallet credentials.

Indicators of compromise (IOCs):
- npm user: hexalpha10 / author: toskypi
- 195.201.194[.]107:8010 (WebSocket C2)
- c2-toskypi.onrender[.]com (HTTP C2)
- huggingface[.]co/api (exfiltration endpoint)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 (persistence)
- MicrosoftSystem64.service (Linux systemd persistence)
- \MicrosoftSystem64 (Windows scheduled task)
- MicrosoftSystem64/payload.js (payload directory)

Defenders: treat unexpected huggingface[.]co/api calls from non-ML workloads as suspicious.

[SafeDep @safedepio]

3rd wave dropped..

3 more packages impersonating emcd[.]io,

@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚊𝚞𝚝𝚑
@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚕𝚘𝚊𝚗𝚜
@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚋𝟸𝚋-𝚙𝚊𝚢-𝚏𝚘𝚛𝚖

1. Downloads a platform-specific second-stage payload from 𝚘𝚘𝚋[.]𝚖𝚘𝚒𝚔𝚊[.]𝚝𝚎𝚌𝚑/𝚙𝚊𝚢𝚕𝚘𝚊𝚍/{𝚙𝚕𝚊𝚝𝚏𝚘𝚛𝚖}using a hardcoded secret key.

2. Writes the payload to ~/.𝚎𝚖𝚌𝚍-𝚟𝚞𝚎_𝚒𝚗𝚒𝚝.𝚓𝚜 (a dot-prefixed hidden file in the user's home directory).

3. Executes the payload immediately via spawn(𝚙𝚛𝚘𝚌𝚎𝚜𝚜.𝚎𝚡𝚎𝚌𝙿𝚊𝚝𝚑, [𝚙𝚊𝚢𝚕𝚘𝚊𝚍_𝚙𝚊𝚝𝚑], 𝚎𝚗𝚟).

4. Reports installation metadata to oob[.]moika[.]tech/report (C2 callback).

Updated Blog: https://t.co/pDdUVfMFZv

Campaign Details: https://t.co/FLwqh6ZnGQ

[ReversingLabs @ReversingLabs]

Full technical analysis, IoC table (31 unique "index.js" SHA-256 hashes), and safe version guidance are available in ReversingLabs’ latest blog:
https://t.co/PVWrsCNtVQ

[Moshe Siman Tov Bustan @MosheTov]

Our technical analysis on the Red Hat compromise now includes a more comprehensive look on the malware - including a 6th(!!!!!!) stage payload dropping logic!

https://t.co/uRhPcbDxuc

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[abhisek @abh1sek]

This is likely the commit that triggered the malicious releases: https://t.co/h6EmnJ77Nd

[abhisek @abh1sek]

The attackers still have access. Pushed a new wave.

[Charlie Eriksen @CharlieEriksen]

We're seeing another wave of malicious versions of RedHat packages starting 15 minutes ago. Stay safe out there.

[Moshe Siman Tov Bustan @MosheTov]

The @redhat-cloud-services compromise appears to be another copycat malware of Shai-Hulud, a new variant after earlier this month they open sourced their Mini Shai-Hulud malware in GitHub.

Over ~280 repositories with stolen credentials, 116,282 weekly downloads, and https://t.co/pc2jflovHp as a decoy C2 server, while actually uploading stolen credentials only to GitHub.

You can read our full analysis here:
https://t.co/pEzdXLGYLR

[Aikido Security @AikidoSecurity]

https://t.co/njxyHJrRll