LOWMalware
Global

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

·Source: The Hacker News

Updated:

Executive Summary

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

Analysis

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Source Attribution

Originally published by The Hacker News on Sep 25, 2026.

Related Threats