Threat intelligence / Malware

Mini Shai-Hulud

[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](https://attack.mitre.org/software/S9008), that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)(Citation: Flashpoint Mini Shai-Hulud MAY 2026)(Citation: FBI TeamPCP JUL 2026)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](https://attack.mitre.org/software/S9008), that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)(Citation: Flashpoint Mini Shai-Hulud MAY 2026)(Citation: FBI TeamPCP JUL 2026)

Labels

malware

56 recorded

Relationships

uses

to Application Access Token

Technique

uses

to Archive Collected Data

Technique

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

to Cloud Account

Technique

uses

to Cloud Accounts

Technique

uses

to Cloud Instance Metadata API

Technique

uses

to Cloud Secrets Management Stores

Technique

uses

to Cloud Services

Technique

uses

to Code Repositories

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Compromise Software Dependencies and Development Tools

Technique

uses

to Container Administration Command

Technique

uses

to Container API

Technique

uses

to Container CLI/API

Technique

uses

to Credentials In Files

Technique

uses

to Data Destruction

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Event Triggered Execution

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Code Repository

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ignore Process Interrupts

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inter-Process Communication

Technique

uses

Technique

uses

to Launch Agent

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Multi-hop Proxy

Technique

uses

to Password Managers

Technique

uses

to Poisoned Pipeline Execution

Technique

uses

to Private Keys

Technique

uses

to Proc Filesystem

Technique

uses

Technique

uses

to Python Startup Hooks

Technique

uses

to Standard Encoding

Technique

uses

to Steal Application Access Token

Technique

uses

to Steal or Forge Authentication Certificates

Technique

uses

to System Checks

Technique

uses

to Systemd Service

Technique

uses

to Systemd Timers

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Traffic Signaling

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

Group

7 external

References

mitre-attack

S9043

FBI TeamPCP JUL 2026

https://www.ic3.gov/CSA/2026/260702.pdf

Flashpoint Mini Shai-Hulud MAY 2026

https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/

Hunt.io TeamPCP Toolkit MAY 2026

https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown

Wiz Mini Shai-Hulud MAY 2026

https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised

Trend Micro TeamPCP MAY 2026

https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html

Phoenix TeamPCP 20 MAY 2026

https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/