data[.]azureDomain

Reported by 1 independent source · first reported 3 Dec 2025 by Zscaler ThreatLabz · last reported 3 Dec 2025

Last reported 10 months ago

What the reports say

1 report, newest first · the exact sentence from each

“…licious repositories or revoking compromised tokens, the failsafe could activate across thousands of infected systems and destroy user data[.]Azure DevOps exploitationThe malware includes specialized logic for detecting and exploiting Azure DevOps build agents running on Linux syst…”

Zscaler ThreatLabzVendor3 Dec 2025
Shai-Hulud V2 Poses Risk To NPM Supply Chain

Indicators reported together

named in the same reports

detected[.]inin 1 report
environment[.]ciin 1 report
history[.]cloudin 1 report
executions[.]datain 1 report
hxxps://raw.githubusercontent[.]com/$in 1 report
repo[.]namein 1 report
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gzin 1 report
hxxps://github[.]com/$in 1 report
below[.]namein 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

detected[.]in
environment[.]ci
history[.]cloud
executions[.]data
hxxps://raw.githubusercontent[.]com/$
repo[.]name
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gz
hxxps://github[.]com/$
below[.]name

Thanks — we review every report.

Report a wrong value