Product
Vault
- First Reported
- Apr 30, 2026
- Latest Reported
- Oct 8, 2026
Reported Context (2)
- stealer malware is designed to harvest credentials across local files, CI environments, Kubernetes, and Vault sources. It also drops the HackBrowserData binary, exfiltrates the collected data, establishes persistence Compromised Tensorlake npm Package Delivered Shai-Hulud Credential-Stealing Worm
- router_runtime.js, is an 11.7 MB heavily obfuscated JavaScript file designed to collect Kubernetes and Vault credentials from environment variables and local files. Stolen secrets are encrypted and exfiltrated Malicious intercom-client npm Release Targets Developer and CI/CD Credentials
Malware (2)
People (1)
Threat Actors (1)
MITRE ATT&CK (4)
Vendors (1)
Products (8)
Tools (1)
Industries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.