Hades Malware Campaign Tricks AI Scanners With Fake Nuclear Prompts

The Hades malware campaign uses prompt injection to bypass AI security scanners in development environments. The attack tricks automated tools into skipping malicious payloads by embedding comments that simulate dangerous instructions. This technique targets Python and JavaScript packages used for scientific and machine-learning workloads.

Malicious code triggers safety failsafes so scanners skip the payload

Malicious code within the compromised packages contains hidden commands designed to trigger safety failsafes in AI-based security checks. These failsafes normally halt scanning when the model detects requests to build biological or nuclear weapons. The injection forces scanners to ignore the actual malware payload entirely.

The campaign compromises approximately 37 Python and 106 JavaScript packages, including typo-squatting variants like rsquests. It uses split loading mechanisms and precompiled binaries to evade detection in sandboxed environments. Self-wiping triggers activate after execution to remove traces of the infection.

Hades now steals credentials from multiple sources including npm, PyPI, RubyGems, JFrog, Kubernetes, AWS, SSH keys, Docker configs, shell histories, .env files, and AI tool configurations. The malware operates as an adversarial technique against CI/CD pipelines and developer tools that rely on automated scanning.

The threat primarily affects development packages used for scientific and machine-learning purposes, though it is not limited to those areas alone. This approach exploits the growing reliance on AI assistants in software supply chains.

Confirmed details include the use of prompt injection against AI scanners, the compromise of specific package counts, and the types of credentials stolen. The attack demonstrates a new vector for targeting developer infrastructure through adversarial prompts.