Malware1 associated actor

gh-token-monitor

Tracked since May 12, 2026 · Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

Vulns0Associated

Actors1Associated

ATT&CK14Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Threat actors

Associated threat actors

1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

TeamPCP

Persistence: .claude/ , .vscode/ , and the gh-token-monitor dead-hand mechanism (the monitor must be removed before rotating tokens, otherwise it may execute rm -rf ~/ ).

via medium slowmistslowmist.medium.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053Scheduled Task/JobEvidence3

~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service

T1053.006Systemd TimersEvidence2

systemctl --user stop gh-token-monitor.service ... rm -f ~/.config/systemd/user/gh-token-monitor.service

Persistence

7 techniques

T1053Scheduled Task/JobEvidence3

~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service

T1053.006Systemd TimersEvidence2

systemctl --user stop gh-token-monitor.service ... rm -f ~/.config/systemd/user/gh-token-monitor.service

T1543Create or Modify System ProcessEvidence2

Install a background service named "gh-token-monitor"

T1543.001Launch AgentEvidence6

Dead-man’s switch : service systemd (Linux) ou LaunchAgent macOS (com.user.gh-token-monitor) qui surveille le token GitHub volé toutes les 60 secondes

T1543.002Systemd ServiceEvidence6

Dead-man’s switch : service systemd (Linux)... qui surveille le token GitHub volé toutes les 60 secondes et exécute un handler distant via eval lors de la révocation

T1547.015Login ItemsEvidence1

On macOS, unload gh-token-monitor with launchctl bootout ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ... On macOS, unload kitty-monitor ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist

T1556Modify Authentication ProcessEvidence1

npm, PyPI, RubyGems, JFrog/Artifactory, GitHub Actions, and AI-tool persistence logic. gh-token-monitor dead-man switch behavior. GitHub Actions secret-dump workflow logic using VARIABLE_STORE and format-results.txt .

Privilege Escalation

6 techniques

T1053Scheduled Task/JobEvidence3

~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service

T1053.006Systemd TimersEvidence2

systemctl --user stop gh-token-monitor.service ... rm -f ~/.config/systemd/user/gh-token-monitor.service

T1543Create or Modify System ProcessEvidence2

Install a background service named "gh-token-monitor"

T1543.001Launch AgentEvidence6

Dead-man’s switch : service systemd (Linux) ou LaunchAgent macOS (com.user.gh-token-monitor) qui surveille le token GitHub volé toutes les 60 secondes

T1543.002Systemd ServiceEvidence6

Dead-man’s switch : service systemd (Linux)... qui surveille le token GitHub volé toutes les 60 secondes et exécute un handler distant via eval lors de la révocation

T1547.015Login ItemsEvidence1

Stealth

1 technique

T1070Indicator RemovalEvidence1

If the token is revoked (HTTP 40x), it executes rm -rf ~/.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Credential Access

4 techniques

T1528Steal Application Access TokenEvidence1

Independent malware analysis... indicates that the encrypted second stage targets GitHub and npm tokens... It also reports a gh-token-monitor persistence mechanism that watches a stolen GitHub token and executes a supplied handler when the token stops working.

T1555Credentials from Password StoresEvidence1

Large-scale credential and secret leakage, including CI/CD, cloud API keys, SSH keys, and more, is probable for any environment exposed.

T1556Modify Authentication ProcessEvidence1

T1649Steal or Forge Authentication CertificatesEvidence1

...using GitHub Actions cache poisoning and token exfiltration techniques... to steal CI/CD, cloud, and developer credentials.

Collection

1 technique

T1119Automated CollectionEvidence1

The worm installs a background process (identified as gh-token-monitor in some variants) that polls the GitHub API every 60 seconds using the stolen token.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Attacker C2 infrastructure includes custom domains. Session messaging, and GitHub repo exfiltration, with redundant failovers ensures persistence and stealth.

Impact

1 technique

T1485Data DestructionEvidence5

Install a background service named "gh-token-monitor" that acts as a wiper by removing all data ("rm -rf ~/; rm -rf ~/Documents") if the stolen GitHub token is revoked by the developer.

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

step security blogNews · Oct 8, 2026Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It - StepSecurityA named malicious service installed by the payload. Every 60 seconds for up to 24 hours, it checks a stolen GitHub token against the GitHub API. If the token is rejected, it triggers deletion of the user's home directory or Windows user profile. The report specifies removing this monitor before revoking the token.Read more ↗snyk blogNews · Aug 4, 2026Inside the keyv npm Supply Chain Compromise | SnykA persistence mechanism associated with the malicious npm supply-chain payload. It monitors stolen GitHub tokens and triggers a handler when the token is revoked or stops working, helping attackers maintain access and react to credential invalidation.Read more ↗medium slowmistNews · May 22, 2026Black May Serial Attacks: The Full Story of the GitHub Breach | by SlowMist | May, 2026 | MediumA persistence and credential-monitoring component used to maintain access to GitHub-related credentials and interfere with remediation unless removed before token rotation.Read more ↗cyberscoopNews · May 19, 2026Mini Shai-Hulud returns, compromising hundreds of npm packages | CyberScoopA monitoring component that continuously checks validity of stolen GitHub tokens and alerts the attacker when a token is revoked, enabling near-real-time awareness of incident response actions.Read more ↗

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actors1Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

gh-token-monitor

Tracked since May 12, 2026 · Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

Vulns0Associated

Actors1Associated

ATT&CK14Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure