Hades malware burrows into AI assistants' own configs, not just their keys

A campaign researchers call Hades has been planting credential-stealing code in open-source packages since March 2026, according to the AI incident archive that catalogues it. The June 2026 wave is the one that matters most: malicious Python wheels fired a hook the instant an interpreter started, pulled down the Bun JavaScript runtime, and then went hunting for the credential files of AI coding assistants — including the rule files and configuration directories of 14 different agents, rewritten so the attacker's hook runs when the assistant next opens the workspace.

The counts differ by a day and by outlet. Orca's Research Pod tallied 26 packages and 37 malicious wheel files on 8 June 2026. Socket Research counted 19 packages and the same 37 wheel files a day earlier. The archive grades the record critical, at confidence A, and marks it landmark and continuing — what sets it apart from the usual run of poisoned packages is that the compromise treated the AI assistant's own configuration as the persistence layer rather than one more file to lift.

The mechanics are the best-established part, because multiple teams examined the same artifacts and described the same chain. Python's site module processes every .pth file during ordinary interpreter initialisation and executes lines beginning with import, so a wheel carrying a file with a -setup.pth suffix runs its obfuscated import hook before any application code — whether or not anything ever imported the package. From there the hook fetches Bun from GitHub and executes an obfuscated _index.js payload. Socket named the sentinel left behind, /tmp/.bun_ran, and the runtime version it observed, v1.3.13; Orca reported both v1.3.13 and v1.3.14 in use. Bun runs where Node isn't installed, which means the payload doesn't show up in the process trees and proxy logs that Node-aware monitoring watches — and any interpreter start in an affected environment, pip included, re-runs the hook.

One account of the entry point doesn't match the others, and the gap matters for detection. InfoWorld's write-up, republished by CSO Online, places the malicious script inside the package's __init__.py and says it runs as soon as infected packages are imported. Orca and Socket, both of which opened the wheel contents, describe a startup hook that needs no import at all. A scanner that reads __init__.py, finds nothing and moves on would clear a wheel that still executes. The wave kept mutating inside its own week: Corgea's inventory of the 9 June follow-on describes langchain-core-mcp 1.4.2 shipping the .pth hook with no bundled _index.js, with the loader instead walking every sys.path entry — and one level below — to find the payload elsewhere in the environment, an answer to scanners that expect loader and payload to arrive together.

The haul reads like a developer-workstation stealer's greatest hits. Orca lists AWS, GCP and Azure authentication tokens, Kubernetes secrets, GitHub personal access tokens and Actions tokens, PyPI, npm and RubyGems publishing credentials, SSH keys, Docker registry configurations, .env files and shell histories; Socket adds Vault tokens, JFrog and CircleCI credentials, cloud CLI caches and wallet data. Orca's description of the memory path is specific: /proc/{pid}/mem on Linux, Mach kernel APIs on macOS, ReadProcessMemory on Windows. StepSecurity, as reported by CSO Online, adds a GitHub Actions variant that reads secrets directly from the runner's address space without ever writing them to disk or making a suspicious network call.

The narrow, newer target is the assistant itself. The record lists model keys and configuration as the prize: ANTHROPIC_API_KEY, Claude Desktop and Claude Code configuration, .mcp.json. Socket's inventory independently names Claude and MCP configuration, and lists recovered artifacts including .claude/setup.mjs and .github/setup.js. CSO Online, citing StepSecurity, says the payload targeted rule files and configuration directories for 14 AI agents, planting prompt instructions or hooks that trigger a bun run bootstrap when the victim loads the workspace with an assistant; Morphisec names some of the 14, among them Claude Code, Cursor, GitHub Copilot, Google Gemini and Codex, and sums up the consequence — uninstalling the malicious package doesn't help, because the malware lives in the AI's configuration. That line is a vendor's pitch and should be read as one, but the underlying claim isn't Morphisec's alone: Orca lists AI assistant configurations among the harvested targets across 14 systems, and Socket describes config poisoning, editor hooks and agent memory abuse. The archive gives the campaign a single point-in-time start of March 2026 at month precision and no end date, and the analyses cited describe exploitation as active when each was written.