Graphalgo campaign spreads to Terraform providers and Go Modules (5 minute read)

2026-09-25

The Graphalgo malware has been found in Terraform providers and Go modules. It hides execution until specific inputs are met, then reports host data and receives encrypted commands via Slack and an Arbitrum Sepolia contract to run Go or Node code. Aikido advises removing affected packages, isolating hosts, rotating credentials, reviewing deployments, and reimaging machines.