Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Black May Serial Attacks: The Full Story of the GitHub Breach
Excerpt
Background Starting in May 2026, after the well-known group TeamPCP open-sourced the Shai-Hulud source code, Shai-Hulud/Mini Shai-Hulud carried out coordinated attacks across multiple supply chain branches within approximately one week. The core logic was: first hijack “high-trust” release channels, then harvest developer and CI credentials, thereby spreading into adjacent ecosystems. SlowMist continued to monitor the situation as it evolved. Subsequently, the question of…
Read the original report →Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 1916faa365f2788b6e193514872d51a242876569 | High | Score 56/100 | First seen |
| SHA256 | ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c | Medium | Score 53/100 | First seen |
| SHA1 | 7cb42f57561c321ecb09b4552802ae0ac55b3a7a | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…