Shai-Hulud’s Reach Just Grew to 469 Credential Locations. Here’s What That Means

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means The Hacker NewsSep 03, 2026Malware / DevOps In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 locations across developer environments, Continuous Integration/Continuous Deployment (CI/CD) tooling, cloud configurations, and even AI tool configs. Earlier variants of the infostealer worm only checked 189 paths. The jump says a lot. Attackers have stopped trying to break trust relationships and started using the credentials that already make those relationships work. Software supply chains have always depended on trust. Developers trust package registries. Organizations trust maintainers. CI/CD systems trust the credentials and identities they're given. Applications trust the dependencies they pull…