Shai-Hulud GitHub Repo Creation

Mehulkumar Savajani@Msavajani

•updated Nov 27, 2025•0•92

This search detects the creation of a public GitHub repository with the description "Sha1-Hulud: The Second Coming". This is a specific indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.