Mini Shai-Hulud Worm Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
3
occurrences
First Seen
June 7, 2026
Last Seen
June 16, 2026

Mini Shai-Hulud Worm is a malware family tracked by ThreatCluster, appearing in 2 threat clusters built from 3 intelligence report mentions.

Mini Shai-Hulud Worm is a malware family tracked across 2 threat clusters and 3 intelligence report mentions on ThreatCluster. First observed June 7, 2026; most recent activity June 16, 2026.

Related Threat Clusters

Recent Intelligence Reports

  • Developer laptops are the credential store attackers are picking through in 2026 ... — Markets.Businessinsider · June 16, 2026
  • Miasma Worm Hits 73 Microsoft GitHub Repos in Second Supply — Mlq.Ai · June 9, 2026
  • Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack — unsafe.sh · June 7, 2026

Frequently asked questions

What is Mini Shai-Hulud Worm?

Mini Shai-Hulud Worm is a malware family tracked by ThreatCluster, appearing in 2 threat clusters built from 3 intelligence report mentions.

Is Mini Shai-Hulud Worm still active?

The most recent intelligence report mentioning Mini Shai-Hulud Worm on ThreatCluster is dated June 16, 2026. Activity was first observed June 7, 2026, giving a tracked span from then to June 16, 2026.

What is Mini Shai-Hulud Worm associated with?

Across ThreatCluster reporting, Mini Shai-Hulud Worm most frequently co-occurs with TeamPCP, Supply Chain Attack, Worm, Miasma Worm Campaign, Trivy → LiteLLM Campaign, among 12 tracked related entities.

What are the latest developments involving Mini Shai-Hulud Worm?

The most significant recent cluster is “GitGuardian Launches Developer Endpoint Protection Amid Rising Credential Theft Risks” (6 articles · Updated June 16, 2026). Mini Shai-Hulud Worm appears across 2 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on Mini Shai-Hulud Worm?

Mini Shai-Hulud Worm appears in 3 intelligence report mentions across 2 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown