![\"Microsoft](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2025\/12\/1765564331_337_0x0.jpg\")
<\/p>\n<\/p>\n
Change your password now, Microsoft urges as Shai-Hulud worm attacks continue.<\/p>\n
NurPhoto via Getty Images<\/p>\n
Updated December 12 with further technical details regarding the Shai-Hulud 2.0 Dune Worm attacks, alongside original reporting of the Microsoft mitigation recommendations for rapid credentials rotation and replacement.<\/p>\n
In response to what the Microsoft Defender Security Research Team has called \u201cone of the most significant cloud-native ecosystem compromises observed recently,\u201d it has urged organizations to act rapidly and replace passwords. Here\u2019s what you need to know about the so-called Shai-Hulud 2.0 Dune Worm attacks.<\/p>\n
ForbesMicrosoft And CISA Issue Critical New Alert, Windows Attacks ConfirmedBy Davey Winder<\/a>Microsoft Issues Critical Warning Following Shai-Hulud 2.0 Dune Worm Attacks<\/p>\n On September 23, the Cybersecurity Infrastructure and Security Agency, which refers to itself as America\u2019s Cyber Defense Agency, issued an urgent alert<\/a> regarding a self-replicating worm, known as Shai-Hulud, targeting Application Programming Interface keys for cloud services such as Amazon Web Services<\/a>, Google Cloud Platform, and Microsoft Azure<\/a>. Fast-forward to now, and the Microsoft Defender Security Research Team has published new guidance for \u201cdetecting, investigating, and defending against the supply chain attack,\u201d as Shai-Hulud 2.0 enters the cyber equation. <\/p>\n \u201cThe Shai\u2011Hulud 2.0 campaign builds on earlier supply chain compromises,\u201d Microsoft said, \u201cbut introduces more automation, faster propagation, and a broader target set.\u201d This includes executing malicious code during the pre-install phase of the infected npm managed packages, which means that it happens before any security checks can be made. \u201cStolen credentials<\/a> are exfiltrated to public attacker-controlled repositories,\u201d the warning continued, \u201cwhich could lead to further compromise.\u201d<\/p>\n This supply chain attack is, Adi Bleih, a security researcher for external risk management at Check Point, told me, unusually aggressive as a result. \u201cBy activating before installation completes and exfiltrating secrets into attacker-controlled GitHub repositories,\u201d Bleih said, \u201cthe operators gained rapid access to significant volumes of cloud and developer credentials.\u201d <\/p>\n ForbesLastPass Data Breach \u2014 Insufficient Security Exposed 1.6 Million UsersBy Davey Winder<\/a>ReversingLabs Dissects Dune Worm<\/p>\n Tomislav Peri\u010din, chief software architect at ReversingLabs, has published an in-depth technical analysis of Sha1-Hulud: The Second Coming. \u201cThe same worm capabilities used in the first wave are also present in the malware of this second wave,\u201d Peri\u010din explained, \u201cin that, once a package is infected, it spawns attacks of its own by allowing the worm to propagate through other open source packages the author maintains.\u201d Peri\u010din confirmed that the ReversingLabs analysis has identified in excess of 27,000 new GitHub repositories created by the Dune Worm during these latest attacks, intended for storing exfiltrated data from compromised users.<\/p>\n According to the RL analysis, Shai-Hulud 2.0 has four main stages:<\/p>\n After compromising an account, the worm looks for other packages maintained by the same account and creates new package versions with a \u201cpostinstall script, adding a malicious bundle.js\u201d that is executed when users install the package itself.The worm\u2019s script looks for environment tokens using the popular open-source TruffleHog tool capable of detecting \u201cmore than 800 different types of secrets, to identify the victims\u2019 secrets.\u201dThese are then exfiltrated to the aforementioned GutHub repositories and double Base64-encoded.Finally, the Shai-Hulud 2.0 worm will try to create public copies of the repositories, described as Shai-hulud Migration. \u201cThe intent appears to be both exposure of source code and secrets embedded in private repos,\u201d Peri\u010din said, \u201cpossibly for the purpose of harvesting and re-use by malicious actors.\u201d<\/p>\n Ken Johnson, chief technology officer of DryRun Security, meanwhile, confirmed that Shai-Hulud 2.0 is the third attack to have been attributed to a threat group identified as S1ngularity. \u201cThis second version of the Shai-Hulud worm tells us the attackers are refining their techniques and improving upon their previous mistakes,\u201d Johnson advised. As such, it\u2019s a \u201cmassively dangerous and disruptive campaign.\u201d<\/p>\n ForbesBeware Of Spiderman-As-A-Service Web Of AttacksBy Davey Winder<\/a>Microsoft Defender Security Research Team Recommendations<\/p>\n The Microsoft Defender Security Research Team mitigation recommendations are unequivocal:<\/p>\n Rapidly rotate and revoke exposed credentials.Review the Key Vault assets on the critical asset management page and investigate any relevant logs for unauthorized access.Isolate affected CI\/CD agents or workspaces.Prioritize high-risk attack paths to reduce further exposure.Remove unnecessary roles and permissions granted to identities assigned to CI\/CD pipelines; specifically review access to key vaults.<\/p>\n Don\u2019t delay, absorb all the Microsoft advice<\/a> and act rapidly as has been recommended. You know it makes sense.<\/p>\n