Webhooks-as-a-Service

Observable Types: domain

Description

Webhooks-as-a-Service made its living-off-the-land debut during the September 2025 Shai Hulud attacks on the NPM supply chain. These services range from free trials to completely anonymous usage.

Blocking these domains neutralizes multiple classes of current malware and data exfiltration.

Techniques

• T1608.001
• T1567.004

References

• https://checkmarx.com/zero-post/npm-hit-by-shai-hulud-the-self-replicating-supply-chain-attack/

Lists

• IPv4 Text
• Domains Text
• CSV
• JSON