Mini Shai-Hulud Supply-Chain Malware - DNS Query to C2 Infrastructure

Leonardo Gasparini@Leonardo.Gasparini

•updated May 13, 2026•6•0•437

Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign. The domain git-tanstack.com is attacker-controlled. The filev2.getsession.org endpoint is used for credential exfiltration via the Session protocol.