🕵️ Hades

The items that name it 9

• Socket: When Autonomous Agents Escape
  articleas threat actors2026-08-30

  Active credential-stealing campaign embedding fake prompt-injection headers to fool AI-assisted review tools into marking code as benign

• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.key entities2026-08-24
• The State of Open Source Supply Chain Attacks
  articleas classification.key entities2026-08-23
• Cloud Threat Highlights: H1 2026
  writeupas threat actors2026-08-06

  PyPI-based variant campaign that followed days after Miasma.

• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas threat actors2026-07-16

  June 2026; evolution of Miasma that added a GitHub Actions secret exfiltration cash-out step. Commits a workflow named 'Run Copilot' (disguised as e.g. .github/workflows/codeql.yml) that dumps repository secrets via toJSON(secrets) into a file, uploads it as an artifact named 'format-results', then

• macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  writeupas threat actors2026-06-23

  Supply-chain payload documented by Socket whose stealer opens with a fake prompt-injection header to pollute AI-assisted analysis

• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas threat actors2026-06-18

  PyPI branch/campaign of the same threat actor as Miasma; executes on import via an obfuscated one-line hook embedded in a package's __init__.py; downloads a standalone Bun runtime and runs a JavaScript payload; reads secrets directly from process memory without writing to disk; ships AI prompt-injec

• Socket: npm Package Uses Prompt Injection + Token Flooding to Evade AI Malware Scanners
  writeupas threat actors2026-06-17

  Related campaign; earlier malicious PyPI wheels used fake prompt-injection headers at the beginning of _index.js payloads to pollute AI-assisted review before the scanner reached the obfuscated Hades payload.

• Miasma & Hades Worms
  writeupas threat actors2026-06-10

  Malware/payload family; JavaScript stealer staged through Bun, targets developer credentials and secrets; branch of the Shai-Hulud and Miasma activity