Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Persistence: .claude/ , .vscode/ , and the gh-token-monitor dead-hand mechanism (the monitor must be removed before rotating tokens, otherwise it may execute rm -rf ~/ ).
14 distinct techniques documented for this family, organized by ATT&CK tactic.
~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service
systemctl --user stop gh-token-monitor.service ... rm -f ~/.config/systemd/user/gh-token-monitor.service
Dead-man’s switch : service systemd (Linux) ou LaunchAgent macOS (com.user.gh-token-monitor) qui surveille le token GitHub volé toutes les 60 secondes
Dead-man’s switch : service systemd (Linux)... qui surveille le token GitHub volé toutes les 60 secondes et exécute un handler distant via eval lors de la révocation
~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service
systemctl --user stop gh-token-monitor.service ... rm -f ~/.config/systemd/user/gh-token-monitor.service
Dead-man’s switch : service systemd (Linux) ou LaunchAgent macOS (com.user.gh-token-monitor) qui surveille le token GitHub volé toutes les 60 secondes
Independent malware analysis... indicates that the encrypted second stage targets GitHub and npm tokens... It also reports a gh-token-monitor persistence mechanism that watches a stolen GitHub token and executes a supplied handler when the token stops working.
Large-scale credential and secret leakage, including CI/CD, cloud API keys, SSH keys, and more, is probable for any environment exposed.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A persistence mechanism associated with the malicious npm supply-chain payload. It monitors stolen GitHub tokens and triggers a handler when the token is revoked or stops working, helping attackers maintain access and react to credential invalidation.
A persistence and credential-monitoring component used to maintain access to GitHub-related credentials and interfere with remediation unless removed before token rotation.
A monitoring component that continuously checks validity of stolen GitHub tokens and alerts the attacker when a token is revoked, enabling near-real-time awareness of incident response actions.
Destructive dead-man-switch component of Shai-Hulud that monitors validity of stolen GitHub tokens and can execute destructive commands such as rm -rf on the victim host if the token is invalidated.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.