socket-dev · Crawled Nov 7, 2026

Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools

13 IoCs 1 Malware

AI Summary

A malicious RubyGems package named strutil-core version 1.0.1 was discovered that executes a credential-stealing worm during installation. The package, published by the RubyGems account jamnajiea, delivers a JavaScript-based payload using the Bun runtime, which collects cloud, CI/CD, package registry, SSH, AI coding tool, and cryptocurrency wallet credentials, then exfiltrates them to paleasbest[.]top. The malware includes self-propagation capabilities across RubyGems, npm, and PyPI, poisons AI development environments by injecting malicious configurations, and installs a Python backdoor that executes scripts from signed GitHub commits. A conditional wiper is triggered if a stolen GitHub token is revoked, leading to deletion of the user's home directory.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Shai-Hulud →

Indicators of Compromise 13 extracted

Type	Value	Detail
Package	[email protected]	Details →
Domain	paleasbest[.]top	Details →
SHA-256	306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9	Details →
Filename	ext/strutil-core/index.js	Details →
SHA-256	c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769	Details →
Filename	ext/strutil-core/extconf.rb	Details →
SHA-256	c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411	Details →
Filename	sync.py	Details →
SHA-256	e29a5319888319b51345ab8e3e009938ee5c2b9ae5d6bdd053f4f44c98f309d3	Details →
Filename	net-health-checker.sh	Details →
Package	[email protected]	Details →
Package	[email protected]	Details →
Package	[email protected]	Details →

MITRE ATT&CK TTPs 43 techniques

T1003.007 Proc Filesystem · Credential Access T1021 Remote Services · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1041 Exfiltration Over C2 Channel · Exfiltration T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1059.006 Python · Execution T1059.007 JavaScript · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1102.001 Dead Drop Resolver · Command And Control T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1195 Supply Chain Compromise · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1195.002 Compromise Software Supply Chain · Initial Access T1485 Data Destruction · Impact T1528 Steal Application Access Token · Credential Access T1530 Data from Cloud Storage · Collection T1543.001 Launch Agent · Persistence T1543.002 Systemd Service · Persistence T1548.003 Sudo and Sudo Caching · Privilege Escalation T1552 Unsecured Credentials · Credential Access T1552.001 Credentials In Files · Credential Access T1553 Subvert Trust Controls · Defense Evasion T1555 Credentials from Password Stores · Credential Access T1562.001 Disable or Modify Tools · Defense Evasion T1566 Phishing · Initial Access T1567.001 Exfiltration to Code Repository · Exfiltration T1614.001 System Language Discovery · Discovery