eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
The Return of Shai Hulud
Bottom Line: A second wave of the Shai Hulud npm supply chain attack has compromised hundreds of widely used packages, including Zapier, ENS, AsyncAPI, PostHog, Browserbase, and Postman, exposing organizations to credential theft and potential cloud infrastructure compromise.
On November 24th, 2025, Aikido published a report on a newly identified npm supply chain attack, involving the Shai Hulud worm, which the attackers labelled as the “Second Coming”. Shai Hulud, named after the sandworm from Dune, is a self-propagating worm that was first observed in September 2025, and was used to steal sensitive information from infected hosts. Stolen data included Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) credentials, followed by the malware uploading them to a public GitHub repository. Shai Hulud was also able to spread itself to other npm packages owned by compromised maintainers, with reports indicating that within days of the initial supply chain attack, Shai Hulud had spread to over 500 npm packages.
Within their report, Aikido identifies some changes that were made to the Shai Hulud worm since its initial attack. One notable update involves the usage of a JavaScript file (setup_bun.js) to install Bun, a JavaScript runtime and all-in-one toolkit. This is used to execute the Shai Hulud code itself, found within another JavaScript file (bun_environment.js). Other changes made to the malware between the attacks involve the creation of randomly named GitHub repositories to expose leaked secrets, an increase to 100 in the number of npm packages that the malware could infect up from 20, and if the malware is unable to authenticate with GitHub or NPM, it will wipe all files from the users Home directory. Like the first wave of attacks, Shai Hulud still features self-propagating capabilities, allowing it to spread itself to other packages owned by the maintainer, through the theft of the account’s credentials, and republish trojanized versions of their packages. The malware also continues to retrieve and utilize the TruffleHog tool to scan infected hosts for secrets that it can steal.
Wiz Research published a report on November 24th as well, indicating that over 700 npm packages had been compromised by Shai Hulud at the time of publication, and claiming that approximately 1000 new repositories containing stolen secrets were being published to GitHub every 30 minutes. Popular packages that were compromised include projects from Zapier, ENS Domains, PostHog, and Postman, which Wiz Research states can potentially be found in approximately 27% of cloud and code environments, with the full list of compromised packages having a total monthly download of over 130 million. In a November 27th update to their report, Wiz Research indicated that approximately 15 malicious packages remained, following actions taken to remove compromised npm packages.
eSentire Threat Intelligence Analysis:
The threat actors behind the initial Shai Hulud campaign in September 2025 were suspected to be behind another npm supply chain attack in August 2025, which targeted s1ngluarity and Nx packages. This initial attack involved compromised npm packages which published leaked data to publicly accessible GitHub repositories. The evolution between the s1ngularity/ Nx compromise to the first Shai Hulud attack demonstrated technical capabilities of the threat actor who was able to adapt their campaign in a short timeframe, with the first campaign being a potential trial run of the attack. The updates observed to the Shai Hulud malware between September and November 2025 also highlight the technical capabilities of the threat actor, incorporating new features into the malware to cause a greater impact. However, in the first wave of the Shai Hulud campaign, the attackers utilized a free Webhook[.]site account for data exfiltration and hit the limits on the free account. During the second wave, Aikido notes that some of the compromised packages did not contain the malicious JavaScript file (bun_environment.js), which may also have prevented the impact of the attack through limiting its spread. So, while the evolution of the campaign can be demonstrated over the past few months, technical limitations observed within the two campaigns can also paint a different picture of the attackers.
Details on the latest wave of npm supply chain attacks involving Shai Hulud indicate that its spread was more successful than its first wave, with it being able to compromise more npm packages within a shorter timeframe. Although the second Shai Hulud wave was able to compromise a greater number of npm packages, Trend Micro reported that the first wave of the attack compromised packages that had over 2 billion downloads per week, suggesting a lesser impact of this second campaign. Aikido highlights the timing of the attack as being notable, as npm is making changes to strengthen its security, along with revoking legacy classic tokens and enforcing granular access tokens, which can limit the impact of compromised accounts. Aikido suggests that the attackers may have tried to seize the moment for “one more hit” before the security changes are enforced. This potentially suggests the idea that the second wave of Shai Hulud may have been more rushed than the first, and that impact may have been lessened by security changes already applied by organizations to npm packages in the wake of previous attacks.
eSentire published an advisory for the second wave of Shai Hulud attacks on November 24th, 2025, while eSentire's Threat Response Unit (TRU) performed threat hunts across eSentire MDR for Endpoint and Log for known Indicators of Compromise (IoCs). eSentire also published an advisory for the initial Shai Hulud attacks in September 2025. Organizations should ensure that the recommended actions from the advisories are followed, as well as reviewing a list of impacted npm packages to ensure that none are observed within the environment, and to rotate credentials for accounts if any are found. Organizations should also follow the OWASP npm Security Best Practices guide, and implement robust Software Bill of Materials (SBOM) tracking to maintain visibility into software supply-chain dependencies. eSentire's Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
Newly Observed ClickFix Variant, Dubbed JackFix
Bottom Line: A new ClickFix variant has been observed in the wild, dubbed JackFix, that utilizes screen hijacking to trick users into executing commands under the guise of applying critical Windows updates. Depending on the success of early activity, JackFix may see wide adoption by threat actors.
On November 25th, 2025, Acronis published a report on a new ClickFix variant dubbed JackFix. This campaign is a variant of the ClickFix attack family and uses fake full-screen “Critical Windows Security Updates” pages to coerce users into running commands that launch multi-stage malware payloads. The delivered malware includes infostealers, loaders, and Remote Access Trojans (RATs).
The attack begins with fake adult websites that mimic popular platforms. These sites are likely distributed through malvertising. Once a victim visits the site, the attackers employ social engineering by displaying a full-screen Windows Update simulation. This creates a sense of urgency, pressuring victims to execute commands under the guise of security updates.
The campaign uses heavy obfuscation with payloads, and ClickFix commands being hidden using hex-encoded arrays. Malicious URLs redirect to benign sites unless accessed through PowerShell, adding another layer of deception. The attackers also use HTML, CSS, and JavaScript to recreate the Windows Update interface and disable escape shortcuts, effectively hijacking the victim’s screen.
The attack chain consists of multiple stages. First, an mshta command downloads a malicious .odd file, which triggers a PowerShell downloader. The second stage involves large, obfuscated PowerShell scripts containing over 20,000 words of junk code. Finally, the attackers deploy up to eight malware samples simultaneously, including Rhadamanthys, Vidar 2.0, RedLine, Amadey, and various loaders and remote access tools. Acronis refers to this method as the “spray-and-pray” approach. Privilege escalation is achieved through repeated User Account Control (UAC) prompts until administrative access is granted. The attackers also add Defender exclusions for Command-and-Control (C2) domains and payload directories to avoid detection.
eSentire Threat Intelligence Analysis:
The campaign’s reliance on adult-site clones suggests opportunistic targeting rather than focused attacks. However, the technical sophistication indicates the actors are capable of pivoting quickly. The fact that the payloads include multiple infostealers and loaders indicates a “shotgun approach” designed to compromise any user who interacts. Although the primary targets appear to be consumer users, corporate environments are equally at risk because the attack relies on human interaction. Any employee who visits compromised or cloned websites, whether intentionally or by accidental redirection, can be exposed to the fake Windows Update screen. Classic social-engineering scams, often referred to as “lure and run” commands under the broader ClickFix umbrella, typically present a generic message such as “You must verify you’re human” or “You need to run this to continue” after a phishing attempt or on a malicious landing page. Combining these messages with a full-screen hijack, a familiar-looking operating system update interface, and adult-site bait significantly increases psychological pressure. In such situations, users may panic, perceive the situation as urgent, and follow the instructions without thinking.
According to ESET, ClickFix campaigns saw a dramatic 517% increase in volume from the second half of 2024 to early 2025, spreading infostealers, ransomware, and RATs. FileFix emerged in late June 2025, with proofs-of-concept shared on June 23rd. With ClickFix already surging, JackFix could quickly become the next big social-engineering threat unless users are vigilant and defensive controls are strengthened. Organizations should educate users about ClickFix attacks and the risks of executing commands from browser prompts. Technical controls should include disabling PowerShell and command-line access for non-administrative users, monitoring for suspicious mshta, PowerShell, and cmd executions, and blocking the malicious domains and IP addresses.
eSentire MDR for Network and Endpoint detects activity related to various information stealers. The Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
Scattered LAPSUS$ Hunters’ Latest Campaign Targeting Zendesk
Bottom Line: Details emerge on Scattered LAPSUS$ Hunters group's new campaign that targets Zendesk customer service platform to steal sensitive credentials. This activity follows the group’s claims of breaching Salesforce’s Gainsight connection, heightening concerns that the actors may expand their targeting to additional organizations in the near future.
On November 26th, 2025, ReliaQuest reported new findings on the threat actor group, Scattered LAPSUS$ Hunters (SLSH). The group is reported to be carrying out a new typosquatting campaign targeting the Zendesk customer service platform to steal user credentials. This campaign is consistent with SLSH’s focus on Software-as-a-Service (SaaS) with a heavier focus on social-engineering techniques to deploy the info-stealing malware and harvest Zendesk credentials, highlighting the group’s ability to exfiltrate data through various initial-access methods.
ReliaQuest identified more than 40 unique Zendesk-themed typosquatted domains in last six months. The domains included other organizations names, likely indicating the intended targets. Some of the identified domains were used to host phishing pages that impersonated Single Sign-On (SSO) sites. These pages would likely be distributed via email and used to harvest credentials and SSO tokens.
In addition to the typosquatted domains, ReliaQuest also observed threat actors submitting fake tickets to legitimate Zendesk portals. This has impacted organizations utilizing Zendesk for customer service. In attacks, fake submissions targeted support and helpdesk personnel with malicious content, that if interacted with, would result in the deployment of unspecified Remote Access Trojans (RATs), as well as other malware. This activity is not specifically attributed to SLSH, but is in line with their known Tactics, Techniques, and Procedures (TTPs).
eSentire Threat Intelligence Analysis:
Scattered LAPSUS$ Hunters is a collective of three threat actor groups, Scattered Spider, LAPSUS$, and ShinyHunters. The groups announced the merger in August of 2025. Despite an announcement that the group was shutting down in September, activity has continued, including the November breach of Salesforce data via Gainsight. SLSH has also recently been in the spotlight for Telegram posts attempting to recruit insider threats from large organizations. In exchange for initial access, SLSH is offering insiders a portion of ransom or extortion payments following successful attacks. These offers are seen as highly concerning, following confirmation that CrowdStrike had fired an employee that had agreed to assist the group. In November, SLSH announced a new Ransomware-as-a-Service (RaaS) dubbed ShinySp1d3r, which is accepting affiliate members.
With recent activity, the group has faced heavy scrutiny from both law-enforcement and security researchers. In September and October, two members of Scattered Spider were arrested in the UK, and a third was arrested in Las Vegas. Notably, this week security researcher Brian Krebs has released the identity of who he claims is the SLSH admin Rey. Due to a series of operational security (Op-Sec) mistakes and publicly available breach data, Krebs identified Saif Al-Din Khader, a 15-year-old living in Jordan, as Rey. Saif later confirmed the accusation in a text interview. Saif claims to have been working with law enforcement since June 2025, but this claim was not validated. Recent arrests and the report that a group admin is working with police may cause some members to limit activity in an attempt to avoid law enforcement attention, but the eSentire Threat Intelligence team assesses that it is highly likely that SLSH members will continue performing ransomware and other attacks in the near-term.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
