The Hades Campaign is an active threat targeting Python developers. It is a software supply chain attack deliberately engineered to outsmart AI-powered security tools. Researchers at StepSecurity have analyzed the campaign in depth, and their findings reveal a significant leap forward in modern evasion techniques.
How the Hades Campaign Works
The Attack Starts With Python Packages
The threat actors distribute malicious Python packages through public repositories. The malicious code triggers automatically the moment the package is imported — no additional user interaction required.
Once executed, the malware leverages the Bun JavaScript runtime to launch multi-stage payloads capable of:
- Harvesting credentials from compromised systems
- Exfiltrating data to attacker-controlled GitHub repositories
- Moving laterally across Linux, macOS, and Windows environments
Notably, the attackers use GitHub itself as command-and-control (C2) infrastructure. The exfiltration repositories carry provocative descriptions such as “Hades — The End for the Damned.”
Weaponizing CI/CD Pipelines
The campaign goes well beyond a simple malicious package. Hades abuses legitimate security mechanisms — SSH/SCP, OpenID Connect (OIDC), and SLSA/Sigstore — within CI/CD environments, particularly GitHub Actions.
As a result, compromised packages are published to PyPI and npm bearing cryptographically verified provenance, making them appear tied to entirely legitimate victim organizations.
The Most Dangerous Feature: Fooling AI
Prompt Injection Against Code-Review Agents
What truly sets the Hades Campaign apart is its ability to bypass AI security agents. Attackers embed adversarial text at the top of source files, effectively instructing automated code-review tools to overlook the malicious payload hidden beneath.
In practice, the malicious file introduces itself to the AI as safe. The AI agent produces a false negative. The harmful code passes review undetected.
Beyond that, the malware targets configuration directories and rules files used by various AI coding assistants, planting custom instructions that activate whenever the user consults their AI tool. This is not just code-level compromise — it is an attack on the decision-making layer itself.
Why This Changes Everything
Until now, organizations relied on AI tools to accelerate code review. That approach now carries a new and serious risk: an attacker can instruct the AI tool to automatically approve malicious content.
To complicate matters further, the campaign has not been attributed to any known APT group, and no victims have been publicly confirmed. This makes risk assessment considerably harder for security teams.
The Bigger Picture: Supply Chain and AI Under Attack
An Accelerating Trend
The Hades Campaign is not an isolated incident. Gartner has documented how threat actors are using generative AI to flood repositories like GitHub with malicious open-source utilities at a volume that outpaces defenders’ ability to respond in real time.
Similar campaigns — such as EvilAI, analyzed by Trend Micro — have already demonstrated how malware can hide inside seemingly legitimate software. The outcome is almost always the same: credential theft and unauthorized access to downstream systems.
Hades adds an unprecedented layer to this threat landscape. It does not just attack the code. It attacks the trust placed in the tools used to evaluate the code.
Recommended Defenses for CISOs and Security Leaders
Researchers have identified the following as top defensive priorities:
- Restrict package installation to approved sources and pinned versions
- Apply the principle of least privilege to CI/CD runners
- Use short-lived tokens for build and release identities
- Separate build identity from release identity in automated workflows
- Treat AI agents as advisory tools, not final approval authorities
However, the most important defense is cultural. No automated system — AI included — should have the autonomous authority to approve a production release. Human review remains non-negotiable.
Organizations must also operate on the assumption that both human reviewers and AI agents can be deceived. Security testing must incorporate scenarios that specifically probe AI tool manipulation.
Conclusion
The Hades Campaign marks a meaningful evolution in software supply chain threats. It targets developers, CI/CD pipelines, and now the very AI tools organizations rely on to defend themselves. For business leaders, the message is unambiguous: software supply chain governance must extend to securing the AI layer as well.
Sources:
- InfoWorld – Meet Hades: The malware that lies to AI security agents
- CSO Online – Meet Hades: The malware that lies to AI security agents
Source: Original article
The Hades Campaign underscores how critical it is for organizations within the same sector to share verified threat intelligence promptly — isolated analysis is simply not enough when supply chain threats evolve faster than individual security teams can respond. IsacChain addresses this challenge directly by providing a secure threat intelligence sharing platform for ISAC members, featuring automated NIS2 compliance that reduces operational burden and blockchain-based verification to guarantee the integrity and non-repudiation of every shared indicator. In a threat landscape where even AI tools can be manipulated, trust in the source of intelligence becomes a non-negotiable requirement. Discover how IsacChain can help your organization at www.isacchain.com