DanSec

Threat actor

Shai-Hulud

In 14 briefs, most recently 8 October 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  2. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  3. The Check Point VPN zero-day exploited by Qilin, the NSO Group WhatsApp spear-phishing campaign, and a SoFi subsidiary breach affecting customer data.
  4. The Dashlane vault breach, the Miasma npm supply chain attack on Red Hat packages, and active exploitation of Windows Netlogon CVE-2026-41089 and Palo Alto …
  5. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  6. The Trust Wallet Chrome extension theft, Ivanti EPMM zero-day attacks, and the DarkSpectre browser extension campaign hitting 2.2 million users.
  7. Cloudflare's record 29.7 Tbps Aisuru botnet DDoS, the Oracle E-Business Suite Clop campaign hitting universities, and WordPress King Addons plugin takeovers.
  8. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  9. Coupang breach exposing 33.7M customers, CodeRED alert platform shut down by Inc ransomware, and SmartTube app compromised via stolen signing keys.
  10. Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
  11. Dartmouth breach via Oracle E-Business Suite by Clop, OnSolve CodeRED emergency alert disruption, and SitusAMC hack hitting US banks, plus Fluent Bit flaws and …
  12. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  13. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  14. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …