Mini Shai-Hulud - IMDS Credential Harvesting from Node.js

Leonardo Gasparini@Leonardo.Gasparini

•updated May 12, 2026•3•0•283

Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints, indicative of credential harvesting.