Posted on

Mandiant AI Coding Assistant Hijack – Shai-Hulud Across About 100 Internal Repositories

Threat Overview

Mandiant documented an intrusion at an unnamed SaaS provider where an attacker hijacked an active AI coding-assistant session. An attacker-poisoned dependency was recommended and accepted, an infostealer was installed through PyPI, GitHub OAuth tokens were stolen, and Shai-Hulud spread across about 100 internal repositories stealing secrets and proprietary source. The attacker then poisoned a package in the victim’s official namespace, causing a second infection.

References

Impacted Systems

Enterprise developer workstations, AI coding assistants and agents, Python/PyPI dependencies, GitHub and internal Git repositories, OAuth tokens, CI/CD systems, and developer secrets. Mandiant did not disclose the assistant vendor, poisoned package name, hashes, infrastructure, initial hijack mechanism, or victim organization.

Why this matters

AI coding assistants increasingly execute commands, install dependencies, and operate with developer credentials. This incident turned one developer session into organization-wide repository and software supply-chain compromise.

Exploitation Status

Confirmed Mandiant incident. Approximately 100 internal repositories were affected. No incident-specific IOC set or public actor attribution is available.

What this hunt looks for

Behavioral sequences involving AI or developer tools launching package managers, PyPI access, OAuth and repository activity, secret-discovery commands, bulk Git operations, Python or Node spawning shells, source archiving, and unusual developer-host network behavior.

Required logs

Microsoft Defender XDR endpoint telemetry ingested into Sentinel, especially DeviceProcessEvents and DeviceNetworkEvents. GitHub or supported SaaS activity in CloudAppEvents adds valuable repository and OAuth context.

First Pass – PyPI Install and Git Activity

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("python.exe","python3","pip.exe","pip3","git.exe","git")
| where ProcessCommandLine has_any ("pip install","python -m pip","pip3 install","git clone","git push")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine,SHA256
| order by Timestamp desc

Developer Tools Launching Package Managers

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName has_any ("code","cursor","claude","copilot","python","node")
| where FileName in~ ("python.exe","python3","pip.exe","pip3","npm.exe","npm","git.exe","git")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

Repository Secret Discovery Commands

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has_any (".env","credentials","token","secret","oauth","GITHUB_TOKEN","AWS_ACCESS_KEY","AZURE_","git config","gh auth")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","python.exe","python3","git.exe","git","gh.exe","gh")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName
| order by Timestamp desc

Bulk Git Repository Operations

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("git.exe","git","gh.exe","gh")
| where ProcessCommandLine has_any ("clone","push","remote add","repo clone","repo create")
| summarize Operations=count(),FirstSeen=min(Timestamp),LastSeen=max(Timestamp),Commands=make_set(ProcessCommandLine,50) by DeviceName,AccountName
| where Operations >= 10
| order by Operations desc

Python or Node Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("python.exe","python3","node.exe","node","npm.exe","npm")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","curl.exe","wget.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

Detection Notes

No incident-specific package, hash, domain, assistant process, or victim IOC was published. Developer activity is naturally noisy. Highest-value results are sequences such as developer/AI process to package installation, token or secret discovery, high-volume Git activity, and archive or outbound behavior.

Leave a comment