gh-token-monitor
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A second process, gh-token-monitor, checks stolen GitHub tokens every 60 seconds — alerting the attacker the moment one is revoked.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniques
Execution
Persistence
6 techniques
Persistence
It also deploys a dead man's switch : a gh-token-monitor service (systemd on Linux / LaunchAgent on macOS) that polls api.github.com/user with the stolen token every 60 seconds.
The monitor then polls hxxps[:]//api[.]github[.]com/user every 60 seconds using a stolen GitHub token. If the API returns any 40x response—indicating the token has been revoked—the monitor executes a configured handler, which in this variant decodes to rm -rf ~/ .
on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
Privilege Escalation
6 techniques
Privilege Escalation
It also deploys a dead man's switch : a gh-token-monitor service (systemd on Linux / LaunchAgent on macOS) that polls api.github.com/user with the stolen token every 60 seconds.
The monitor then polls hxxps[:]//api[.]github[.]com/user every 60 seconds using a stolen GitHub token. If the API returns any 40x response—indicating the token has been revoked—the monitor executes a configured handler, which in this variant decodes to rm -rf ~/ .
on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
Stealth
1 technique
Stealth
Credential Access
2 techniques
Credential Access
Exfiltration
1 technique
Exfiltration
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A monitoring component that continuously checks validity of stolen GitHub tokens and alerts the attacker when a token is revoked, enabling near-real-time awareness of incident response actions.
Destructive dead-man-switch component of Shai-Hulud that monitors validity of stolen GitHub tokens and can execute destructive commands such as rm -rf on the victim host if the token is invalidated.
A daemon observed on developer machines during the campaign that monitors stolen GitHub tokens, polls GitHub periodically, and may attempt destructive cleanup by wiping the user's home directory if a monitored token is revoked.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.