hxxp://metadata[.]google[.]internal

Posts referencing this indicator

• Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack

  Socket

  GCP IMDS endpoint targeted by the malware to harvest cloud credentials

  2026-05-13