Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches

A routine software update can now open the door to a cloud breach. Attackers are hiding credential stealing malware inside trusted packages and development tools, allowing malicious code to run on developer computers and automated build systems before an application even starts. The threat spans several campaigns rather than one malware family. Shai-Hulud emerged in September 2025, while later operations targeted additional programming ecosystems and security tools. Once attackers obtain working credentials, they can access cloud storage, inspect infrastructure, steal data, or establish lasting access. Qualys researchers noted this recurring pattern in their September 28 analysis.…