Hades Campaign Bun Payload Execution

Duo Tech@duotech

•updated Jun 9, 2026•0•0•2

Detects execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This campaign leverages malicious `*-setup.pth` files to download Bun and run an obfuscated JavaScript credential stealer.