Clankerusecase
Linux detection coverage
 ← Back to main site
Home/ Targets/ Linux

🐧Linux detections

Clankerusecase tracks 539 detection use cases covering the Linux attack surface across 183 MITRE ATT&CK techniques.

Detections targeting Linux servers and workstations — auditd / Sysmon for Linux / syslog.

Open Detection Library → View on the matrix
539Use cases
183Techniques
60Articles
6Kill-chain phases

Top techniques on Linux (25)

T1195.002Compromise Software Supply Chain141T1071.001Web Protocols98T1059.004Unix Shell96T1190Exploit Public-Facing Application72T1552.001Credentials In Files71T1105Ingress Tool Transfer67T1059.007JavaScript65T1059.006Python59T1204.002Malicious File50T1041Exfiltration Over C2 Channel34T1059.001PowerShell30T1059Command and Scripting Interpreter29T1567Exfiltration Over Web Service27T1546Event Triggered Execution20T1068Exploitation for Privilege Escalation19T1505.003Web Shell19T1611Escape to Host19T1036.005Match Legitimate Resource Name or Location19T1546.016Installer Packages17T1059.003Windows Command Shell15T1528Steal Application Access Token14T1027Obfuscated Files or Information14T1083File and Directory Discovery14T1195.001Compromise Software Dependencies and Development Tools13T1552.005Cloud Instance Metadata API12

Reconnaissance (7)

[LLM] Vulnerable meta-ads-mcp installation inventory (CVE-2026-48039) on managed hosts Bespoke recon · hunting DSPDDCS [LLM] github.com/dhax/go-base supply-chain footprint in go.mod / build artifacts Bespoke recon · hunting DSΣPDDCSCW [LLM] Internal host clones / curls github.com/dhax/go-base or raw dev.env Bespoke recon · hunting DSΣPDDCS [LLM] Browser writing oversized OPFS file (potential FROST SSD-timing side-channel) Bespoke recon · hunting DSΣPDDCS [LLM] Algernon vulnerable installation discovery (CVE-2026-45721 exposure inventory) Bespoke recon · hunting DSPDDCS [LLM] Vulnerable utcp-cli package (<= 1.1.1) inventory hunt for CVE-2026-45369 Bespoke recon · hunting DSPDD [LLM] n8n host inventory hunt — surface vulnerable instances < 1.123.43 / 2.20.7 / 2.22.1 Bespoke recon · hunting DSPDDCS

Delivery (52)

[WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [LLM] Atomic Arch: makepkg child spawning npm install atomic-lockfile or bun install js-digest Bespoke delivery · alerting DSΣPDDCS [LLM] Internet-facing web service spawning interactive SSH into management subnet Bespoke delivery · alerting DSΣPDDCS [LLM] First-seen device/user authenticating to Tchap (tchap.gouv.fr) matrix endpoint Bespoke delivery · hunting DSPDDCS [LLM] Miasma supply-chain worm leaked repo clone, install or fetch Bespoke delivery · alerting DSΣPDDCS [LLM] Cargo dependency manifest or download pinned to compromised onering 1.4.1 Bespoke delivery · hunting DSPDDCS [LLM] Miasma-tainted package install: binding.gyp dropped into known-compromised npm package paths Bespoke delivery · alerting DSΣPDDCS [LLM] Hades/Miasma PyPI poisoned package installation (26 named packages) Bespoke delivery · alerting DSΣPDDCS [LLM] Phar archive or PHPSpreadsheet RCE marker written by web-server process Bespoke delivery · alerting DSΣPDDCS [LLM] Bun runtime download to /tmp from a node process during npm install Bespoke delivery · alerting DSPDDCS [LLM] Nx Console v18.95.0 Malicious Payload Bootstrap via Orphan Commit (npx github:nrwl/nx#558b09d7) Bespoke delivery · alerting DSΣPDDCS [LLM] jqwik-engine 1.10.0 malicious JAR on disk (SHA256 / filename match) Bespoke delivery · hunting DSΣPDDCS [LLM] vpmdhaj typosquat npm package install via preinstall hook (node child of npm) Bespoke delivery · alerting DSΣPDDCS [LLM] npm/pnpm install of trojanized codexui-android package on developer endpoint Bespoke delivery · hunting DSΣPDDCS [LLM] Yamcs MDB algorithm override PATCH with Java Runtime payload Bespoke delivery · hunting SΣPDD [LLM] BTMOB Android RAT APK SHA256 sighting in file or email telemetry Bespoke delivery · hunting DSΣPDDCS [LLM] Compromised laravel-lang Composer package: helpers.php in vendor tree Bespoke delivery · hunting DSΣPDDCS [LLM] Composer install of malicious helpers.php in laravel-lang vendor package Bespoke delivery · hunting DSΣPDDCS [LLM] Nx Console v18.95.0 compromised extension installed (May 2026 supply-chain attack) Bespoke delivery · hunting DSΣPDDCS [LLM] Compromised Microsoft durabletask PyPI Package Install (TeamPCP 1.4.1-1.4.3) Bespoke delivery · alerting DSΣPDDCS [LLM] Installation of malicious guardrails-ai==0.10.1 PyPI package (CVE-2026-45758) Bespoke delivery · alerting DSΣPDDCS [LLM] npm install of compromised @opensearch-project/opensearch versions 3.5.3/3.6.2/3.7.0/3.8.0 Bespoke delivery · alerting DSΣPDDCS [LLM] mistralai 2.4.6 dropper: curl downloading transformers.pyz from 83.142.209.194 Bespoke delivery · hunting DSΣPDDCS [LLM] Malicious node-ipc package landed on disk under node_modules Bespoke delivery · hunting DSΣPDDCS [LLM] Install of trojaned elementary-data 0.23.3 via pip / poetry / uv Bespoke delivery · alerting DSΣPDDCS [LLM] Docker / Kubernetes pull of compromised ghcr.io/elementary-data/elementary image Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised elementary-data==0.23.3 PyPI install on developer / CI host Bespoke delivery · alerting DSΣPDDCS [LLM] Mailcow quarantine XSS via EICAR + HTML in attachment filename (GHSA-2xjc-rg88-jvpp) Bespoke delivery · alerting DSΣPDD [LLM] node process spawning bash/curl chain to fetch Velora DEX install.sh dropper Bespoke delivery · alerting DSΣPDDCS [LLM] Malicious axios or plain-crypto-js package files written to node_modules Bespoke delivery · hunting DSΣPDDCS [LLM] pip install of malicious telnyx versions 4.87.1 / 4.87.2 Bespoke delivery · alerting DSΣPDDCS [LLM] WAV-disguised stager pull from TeamPCP loader 83.142.209.203:8080 Bespoke delivery · hunting DSΣPDDCS [LLM] npm/node postinstall hook spawning interpreter and reaching new C2 host (Axios-style dropper) Bespoke delivery · hunting DSPDDCS [LLM] Telnyx PyPI compromise: malicious telnyx 4.87.1 / 4.87.2 hash on disk Bespoke delivery · hunting DSΣPDDCS [LLM] TeamPCP WAV-stego payload drop (hangup.wav / ringtone.wav) Bespoke delivery · alerting DSPDDCS [LLM] Compromised bittensor-wallet 4.0.2 source-tarball SHA256 on disk Bespoke delivery · hunting DSΣPDD [LLM] Malicious typosquat npm packages installed on disk (ts-bign / big-nunber / levex-refa / lint-builder) Bespoke delivery · hunting DSΣPDD [LLM] GitHub Actions workflow file referencing compromised xygeni/xygeni-action@v5 or backdoored commit 4bf1d4e Bespoke delivery · alerting DSΣPDDCS [LLM] Malicious litellm 1.82.7/1.82.8 wheel install drops litellm_init.pth in site-packages Bespoke delivery · alerting DSΣPDDCS [LLM] Cloudflare-tunnel curl-piped Python stager (kamikaze.sh / kube.py) Bespoke delivery · alerting DSΣPDDCS [LLM] GlassWorm Mar 2026 wave — compromised npm/VS Code package artifacts on disk Bespoke delivery · alerting DSΣPDD [LLM] tj-actions/changed-files compromise: self-hosted runner egress to nikitastupin memdump gist (CVE-2025-30066) Bespoke delivery · hunting DSΣPDD [LLM] Pastebin-piping stager retrieved from rentry.co/openclaw-core (macOS/Linux ClawHub skill) Bespoke delivery · alerting DSPDDCS [LLM] PyPI install of malicious typosquat spellcheckpy or spellcheckerpy Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised Nx npm package version install on developer or CI host Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised npm package @vietmoney/react-big-calendar@0.26.2 installation (Shai-Hulud 3.0) Bespoke delivery · alerting DSΣPDDCS [LLM] NPM preinstall hook fetching Bun installer from bun.sh (Sha1-Hulud dropper) Bespoke delivery · alerting DSΣPDDCS [LLM] DNS / outbound connection to npnjs[.]com phishing infrastructure Bespoke delivery · alerting DSΣPDD [LLM] Compromised tj-actions/changed-files commit SHA referenced on host (CVE-2025-30066 IOC hunt) Bespoke delivery · alerting DSΣPDDCS [LLM] Self-hosted GitHub Action runner downloads memdump.py from compromised gist (CVE-2025-30066) Bespoke delivery · alerting DSΣPDDCS [LLM] Go typosquat module reference: github.com/boltdb-go/bolt in process or build telemetry Bespoke delivery · alerting DSΣPDDCS [LLM] Inbound UDP/631 (CUPS IPP discovery) from external network Bespoke delivery · hunting DSΣPDDCS

Exploitation (90)

[WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) Internal exploit · alerting DSPDD [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) Internal exploit · alerting DSPDDCS [WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint Internal exploit · alerting DSPDD [WEEKLY] Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution Internal exploit · alerting DSΣPDD [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain Internal exploit · alerting DSPDD [WEEKLY] Linux LPE chain — anomalous algif_aead/esp4/esp6/rxrpc kernel-module load followed by same-user root transition Internal exploit · alerting DSPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool Internal exploit · alerting DSΣPDD [WEEKLY] Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write Internal exploit · alerting DSPDD [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain Internal exploit · alerting DSΣPDD [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens Internal exploit · alerting DSΣPDD [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Internal exploit · alerting DSPDD [LLM] Splunk PostgreSQL sidecar (postmaster/postgres) spawning shell or scripting interpreter Bespoke exploit · alerting DSΣPDDCS [LLM] Shell or recon binary spawned by Tomcat/Java on Ivanti Sentry (CVE-2026-10520 post-exploitation) Bespoke exploit · alerting DSΣPDDCS [LLM] CVE-2026-48039 PoC artifact execution (meta-ads-mcp-vuln001 image, FAKE_TOKEN_FOR_POC_DEMO env) Bespoke exploit · alerting DSΣPDDCS [LLM] HEEx / Elixir Kernel injection markers in BEAM-spawned process command line (CVE-2026-8467) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blo Bespoke exploit · hunting DSP Article-specific behavioural hunt — Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System Bespoke exploit · hunting DSP [LLM] nebula-mesh CVE-2026-47724 — cross-operator admin API key mint via POST /api/v1/operators/{id}/api-keys Bespoke exploit · alerting SΣPDD [LLM] osascript invoked with AppleScript breakout pattern (mismatched tell blocks + do shell script) Bespoke exploit · alerting DSΣPDDCS [LLM] Web-server process (php-fpm / apache / nginx / w3wp) spawning shell or network tooling Bespoke exploit · hunting DSΣPDDCS [LLM] Unprivileged user namespace + nf_tables manipulation chain (CVE-2026-23111 exploitation) Bespoke exploit · alerting DSPDDCS [LLM] nft (nftables) ruleset manipulation by non-root account on Linux endpoints Bespoke exploit · hunting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-47731: NASA AMMOS Instrument Toolkit: Path traversal Bespoke exploit · hunting DSP [LLM] Claude Code Action Read tool exfil: node opens /proc/<pid>/environ on Linux CI runner Bespoke exploit · alerting DSΣPDDCS [LLM] Claude Code Read tool steered to cloud-credential files on GitHub Actions runner Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-47670: Authenticated Remote Code Execution via loadRe Bespoke exploit · hunting DSP [LLM] DbGate CVE-2026-47668 — Node.js runner spawning shell/LOLBin children for egress Bespoke exploit · alerting DSΣPDDCS [LLM] Passwordless sudo rule dropped into /etc/sudoers.d (Miasma privilege escalation) Bespoke exploit · alerting DSΣPDDCS [LLM] Security vendor domain blackhole written to /etc/hosts from non-admin process Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) Bespoke exploit · hunting DSP [LLM] Privileged container launch — docker run --privileged from non-CI parent Bespoke exploit · alerting DSΣPDDCS [LLM] Container escape via cgroups release_agent write (CVE-2022-0492) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-47391: PraisonAI's unauthenticated A2A official examp Bespoke exploit · hunting DSP [LLM] Suspicious child process spawned by PraisonAI uvicorn/python A2A server (eval() RCE evidence) Bespoke exploit · alerting DSΣPDDCS [LLM] PraisonAI Python subprocess spawns OS shell with discovery / credential-reading commands Bespoke exploit · alerting DSPDDCS [LLM] Literal PraisonAI sandbox-escape signature: `print.__self__` + builtins dict access Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-47393: PraisonAI `deploy --type api` emits a Flask se Bespoke exploit · hunting DSP [LLM] Node.js process spawning OS shell with enumeration commands — vm2 sandbox escape (CVE-2026-47137) Bespoke exploit · hunting DSΣPDDCS [LLM] Web service in container spawning interactive shell (Redis/nginx RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Container privilege escalation via Looney Tunables, PwnKit, sudo chroot Bespoke exploit · alerting DSΣPDDCS [LLM] Yamcs MDB algorithm PATCH with embedded Jython java.lang.Runtime payload (CVE-2026-46621) Bespoke exploit · alerting DSΣPDDCS [LLM] Hazy Scorpius (CL0P) Oracle EBS exploitation via CVE-2025-61882 — concurrent processing spawns shell/wget Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens Bespoke exploit · hunting DSP [LLM] Node.js web process spawning shell (LiquidJS RCE post-exploit) Bespoke exploit · alerting DSΣPDDCS [LLM] Yamcs JVM spawning OS shell/interpreter (Janino RCE via CVE-2026-44632) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-46703: Boxlite: Path Traversal Vulnerability Leads to Bespoke exploit · hunting DSP [LLM] OCI image extraction creates symlink with absolute path target (CWE-61 primitive) Bespoke exploit · alerting DSΣPDDCS [LLM] Kopia process spawns ssh with -oProxyCommand= argument (CVE-2026-45695) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks aga Bespoke exploit · hunting DSP [LLM] GlassFish java process spawning command shell (CVE-2026-2587 RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Inbound HTTP request with Camel-internal header or query param to CXF/Knative endpoint (CVE-2026-47323) Bespoke exploit · alerting DSΣPDDCS [LLM] Algernon web server spawning shell child process (CVE-2026-45721 handler.lua RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] MLflow server process spawning Claude Code CLI or shell — CVE-2026-2611 RCE chain Bespoke exploit · alerting DSΣPDDCS [LLM] Web-server process (w3wp/php/nginx) spawns shell or LOLBin (post-SSTI RCE chain) Bespoke exploit · alerting DSΣPDDCS [LLM] Node.js process spawning shell or system utility — likely vm2 sandbox escape Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-45369: utcp-cli Vulnerable to Command Injection via U Bespoke exploit · hunting DSP [LLM] utcp-cli command injection via UTCP_ARG substitution in python→bash -c CMD_N_OUTPUT script Bespoke exploit · alerting DSΣPDD [LLM] Marten CVE-2026-45288 injection observed executing in PostgreSQL audit log Bespoke exploit · alerting SΣPDD [LLM] DeepSeek-TUI sub-agent shell execution via AGENTS.md prompt injection (CVE-2026-45374) Bespoke exploit · alerting DSΣPDD [LLM] DeepSeek-TUI spawning 'cargo test' — CVE-2026-45311 auto-approved run_tests pathway Bespoke exploit · hunting DSΣPDD [LLM] Rust cargo-test binary in target/debug/deps spawning shell or network tool (CVE-2026-45311 exploitation) Bespoke exploit · alerting DSΣPDD [LLM] Portainer Swarm service spec with elevated Linux capabilities or unconfined Seccomp Bespoke exploit · alerting DSΣPDDCS [LLM] Container start with docker.sock or sensitive host-path bind mount Bespoke exploit · alerting DSΣPDDCS [LLM] Docker local-driver volume created with type=none and o=bind (CVE-2026-44849 volume variant) Bespoke exploit · alerting DSΣPDDCS [LLM] n8n Node.js parent spawning OS shell — post-exploit RCE indicator for CVE-2026-44791 Bespoke exploit · alerting DSΣPDDCS [LLM] Flowise node.exe Spawning OS Shell or Command-Line Utility - Post-Exploit RCE (CVE-2026-46442) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Bespoke exploit · hunting DSP Article-specific behavioural hunt — Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Bespoke exploit · hunting DSP Article-specific behavioural hunt — hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft Bespoke exploit · hunting DSP [LLM] TeamPCP Linux/Mac stdin-piped Python second stage (sys.executable -) Bespoke exploit · hunting DSPDDCS Article-specific behavioural hunt — How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM Bespoke exploit · hunting DSP Article-specific behavioural hunt — CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran Bespoke exploit · hunting DSP Article-specific behavioural hunt — TeamPCP deploys CanisterWorm on NPM following Trivy compromise Bespoke exploit · hunting DSP [LLM] GlassWorm invisible-Unicode decoder signature (variation-selector eval loader) in process cmdline Bespoke exploit · hunting DSΣPDD [LLM] Storybook portable-stories RCE — vitest/node spawning shell, recon or secret-grep child (CVE-2026-27148) Bespoke exploit · alerting DSΣPDDCS [LLM] curl | bash or wget | sh executed by Claude/Cursor/OpenClaw agent process Bespoke exploit · alerting DSΣPDDCS [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic Bespoke exploit · alerting DSΣPDDCS [LLM] Node.js process spawning interactive shell — suspected post-exploit RCE on Next.js / RSC server Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Malicious MCP Server on npm postmark-mcp Harvests Emails Bespoke exploit · hunting DSP Article-specific behavioural hunt — s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malw Bespoke exploit · hunting DSP [LLM] GitHub Actions self-hosted runner spawning curl/wget POST to non-allowlisted egress Bespoke exploit · hunting DSPDDCS Article-specific behavioural hunt — Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security In Bespoke exploit · hunting DSP Article-specific behavioural hunt — Reconstructing the TJ Actions Changed Files GitHub Actions Compromise Bespoke exploit · hunting DSP [LLM] Malicious tj-actions base64 payload prefix observed in process command line Bespoke exploit · alerting DSΣPDDCS [LLM] GitHub Actions branch-name template injection — bash brace-expansion shell signature Bespoke exploit · alerting DSΣPDDCS [LLM] cups-browsed spawning foomatic-rip or shell child (CVE-2024-47177 RCE) Bespoke exploit · alerting DSΣPDDCS Article-specific behavioural hunt — Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID Bespoke exploit · hunting DSP [LLM] Curl invoked with SOCKS5-hostname resolution (CVE-2023-38545 exploit precondition) Bespoke exploit · hunting DSΣPDDCS Article-specific behavioural hunt — What are AI hallucinations and why should developers care? Bespoke exploit · hunting DSP

Installation (171)

[WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains Internal install · alerting DSPDDCSCW [WEEKLY] Developer package install spawning script-host with non-registry C2 within 5 minutes Internal install · alerting DSPDD [WEEKLY] Internet-facing server process spawns interpreter then beacons to first-seen external host within 5 minutes Internal install · alerting DSPDD [WEEKLY] Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) Internal install · alerting DSΣPDD [WEEKLY] npm Install-Time Lifecycle Hook Triggers Outbound Egress to Newly-Seen Domain (Shai-Hulud/Miasma/IronWorm pattern) Internal install · alerting DSPDD [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package install lifecycle hook spawns interpreter that reads developer credential stores Internal install · alerting DSPDDCS [WEEKLY] Package-install lifecycle script harvests local credentials and beacons to a non-baselined domain Internal install · alerting DSPDD [WEEKLY] Package-manager child process credential fan-out with public egress (Mini Shai-Hulud / TeamPCP worm chain) Internal install · alerting DSPDD [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access Internal install · alerting DSPDD [WEEKLY] Package-manager install hook spawns interpreter that beacons to non-registry host within 120s Internal install · alerting DSPDD [WEEKLY] Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry Internal install · alerting DSPDD [WEEKLY] Package-Manager Install -> Interpreter Child -> Non-Registry Egress Within 5 Minutes Internal install · alerting DSPDD [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s Internal install · alerting DSPDD [WEEKLY] Package manager lifecycle hook spawns network-fetching shell or runtime Internal install · alerting DSΣPDD [WEEKLY] Package manager lifecycle hook spawns runtime with outbound egress to non-registry host within 5 minutes Internal install · alerting DSPDD [WEEKLY] Package manager spawns network-fetching child to public code-hosting within minutes of install Internal install · alerting DSPDD [WEEKLY] Web-Server Process Post-Exploit Anchor: Plugin/Extension RCE Leading to Shell Spawn or Webroot Script Drop Internal install · alerting DSΣPDD [LLM] Velvet Ant PAM backdoor — unauthorized pam_unix.so / PAM module modification on Linux Bespoke install · alerting DSΣPDDCS [LLM] Velvet Ant trojanized OpenSSH — unauthorized sshd/ssh/scp binary replacement Bespoke install · alerting DSΣPDDCS [LLM] Splunk Secure Gateway Python script overwritten via PostgreSQL lo_export (CVE-2026-20253) Bespoke install · alerting DSΣPDDCS [LLM] AUR helper or makepkg spawning npm/node to install atomic-lockfile or js-digest Bespoke install · alerting DSΣPDDCS [LLM] eBPF program load or pinned object created from non-system parent on Arch host Bespoke install · hunting DSΣPDDCS [LLM] Persistence written to user shell init or systemd user units from AUR build/install scriptlet Bespoke install · hunting DSΣPDDCS [LLM] Atomic Arch: deps ELF execution by SHA256/MD5 or src/hooks/deps path Bespoke install · hunting DSΣPDDCS [LLM] Atomic Arch: systemd unit with Restart=always dropped by non-package-manager process Bespoke install · hunting DSΣPDDCS [LLM] Atomic Arch: eBPF rootkit pinned maps hidden_pids/hidden_names/hidden_inodes in /sys/fs/bpf/ Bespoke install · alerting DSΣPDDCS [LLM] Unauthorized write to Linux PAM authentication module (pam_unix.so swap) Bespoke install · alerting DSΣPDDCS [LLM] Unauthorized modification of OpenSSH sshd or ssh client binary Bespoke install · alerting DSΣPDDCS [LLM] First-seen pam_unix.so / sshd / ssh binary hash in Linux fleet Bespoke install · hunting DSPDDCS [LLM] Atomic Arch — pacman/makepkg post-install spawning npm install of atomic-lockfile Bespoke install · alerting DSΣPDDCS [LLM] Atomic Arch — ELF payload 'deps' written or executed under build/cache directories after AUR install Bespoke install · alerting DSΣPDDCS [LLM] Atomic Arch rootkit — eBPF program load by AUR-build-chain descendant Bespoke install · hunting DSPDD [LLM] AI coding agent (Claude Code / Cursor / Codex) spawning shell that fetch-and-executes remote payload Bespoke install · alerting DSΣPDDCS [LLM] Unexpected .jsp files written under PSEMHUB.war web application Bespoke install · alerting DSΣPDDCS [LLM] PeopleSoft XMLDecoder persistence — XML file changes under envmetadata/data/environment Bespoke install · alerting DSΣPDDCS [LLM] npm/yarn/pnpm install or upgrade of Baileys package Bespoke install · hunting DSΣPDDCS [LLM] MIPS shell-script dropper on Linux edge device — JDY architecture-aware payload fetch Bespoke install · hunting DSΣPDDCS [LLM] Ivanti Sentry unauthenticated admin account creation (CVE-2026-10523) Bespoke install · alerting DSPDDCS [LLM] Pheditor CVE-2026-48030 — web server spawning shell interpreter from terminal handler RCE Bespoke install · alerting DSΣPDDCS [LLM] Pheditor CVE-2026-48030 — webshell drop: PHP / web account writing .php to webroot Bespoke install · alerting DSΣPDDCS [LLM] BEAM / Erlang VM spawns shell or interpreter child (post-RCE — CVE-2026-8467) Bespoke install · alerting DSΣPDDCS [LLM] Miasma payload SHA256 hash hit (published Phantom Gyp IOCs) Bespoke install · hunting DSΣPDDCS [LLM] Python interpreter downloading Bun runtime ZIP from oven-sh GitHub release Bespoke install · alerting DSPDDCS [LLM] Hades persistence: *-setup.pth file written into Python site-packages Bespoke install · alerting DSΣPDDCS [LLM] LiteLLM proxy (uvicorn/python) spawning shell or LOLBin — CVE-2026-42271 post-exploit Bespoke install · alerting DSΣPDDCS [LLM] Qilin Linux ransomware ELF payload (CVE-2026-50751 campaign) — known MD5 file event Bespoke install · hunting DSΣPDDCS [LLM] AGENTPSD-style Python reverse shell spawned by sshd on Linux / NAS Bespoke install · hunting DSΣPDDCS [LLM] pfSense / firewall config change enabling Web SSL VPN after admin login Bespoke install · hunting SPDD [LLM] DbGate node process spawning shell child (post-exploit RCE) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-47669: DbGate: Zip Slip in archive/unzip allows arbit Bespoke install · hunting DSP [LLM] DbGate Zip Slip (CVE-2026-47669): node process writes outside archive dir to OS-sensitive paths Bespoke install · alerting DSΣPDDCS [LLM] Enterprise Gateway python container spawns shell or reads K8s service-account token (CVE-2026-44181 RCE) Bespoke install · alerting DSΣPDDCS [LLM] Cron/persistence file written on Kubernetes worker node from container runtime context Bespoke install · alerting DSΣPDDCS [LLM] Bun runtime spawned via node→shell→bun chain from npm install (Miasma dropper) Bespoke install · alerting DSΣPDDCS [LLM] npm preinstall hook executing oversized node index.js from @redhat-cloud-services package Bespoke install · alerting DSΣPDDCS [LLM] Bun spawned from npm install context executing /tmp/p*.js implant Bespoke install · alerting DSΣPDDCS [LLM] PHP CLI drops hidden /tmp dropper artefacts (Laravel-Lang autoload payload) Bespoke install · alerting DSΣPDDCS [LLM] Nx Console v18.95.0 Compromised VSIX / main.js / payload SHA-256 Hash Match Bespoke install · hunting DSΣPDDCS [LLM] macOS LaunchAgent Persistence — com.user.kitty-monitor.plist (Nx Console Compromise) Bespoke install · alerting DSΣPDDCS [LLM] Kitty cat.py Python Backdoor File Drop / Execution (Nx Console Compromise) Bespoke install · alerting DSΣPDDCS [LLM] runC binary modified outside package manager (CVE-2019-5736 / CVE-2024-21626) Bespoke install · alerting DSΣPDDCS [LLM] Vulnerable praisonai-platform deployment hunt (uvicorn launching praisonai_platform.api.app) Bespoke install · hunting DSΣPDDCS [LLM] PraisonAI A2A example server started with vulnerable 0.0.0.0 bind and no auth_token Bespoke install · hunting DSΣPDDCS [LLM] PraisonAI `deploy --type api` command execution — vulnerable server provisioned Bespoke install · hunting DSΣPDDCS [LLM] perfctl rootkit — /etc/ld.so.preload write or LD_PRELOAD on root daemon Bespoke install · alerting DSΣPDDCS [LLM] __DAEMONIZED=1 environment marker on spawned process Bespoke install · alerting DSΣPDDCS [LLM] Yamcs JVM spawns shell or network utility (CVE-2026-46621 post-exploitation) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-46562: Yamcs Vulnerable to Remote Code Execution via Bespoke install · hunting DSP [LLM] Yamcs JVM spawning a POSIX shell — Nashorn Runtime.exec post-exploitation Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — [GHSA / CRITICAL] CVE-2026-45618: LiquidJS is Vulnerable to Remote Code Executio Bespoke install · hunting DSP [LLM] Mini Shai-Hulud 'gh-token-monitor' persistence daemon (LaunchAgent / systemd) Bespoke install · alerting DSΣPDDCS [LLM] Laravel-Lang stealer file drop in .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] Stealer or VBS launcher dropped into .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] Megalodon backdoor workflow file (SysDiag.yml / Optimize-Build.yml) written to .github/workflows/ Bespoke install · alerting DSΣPDDCS [LLM] Boxlite sandbox writes to SSH authorized_keys (post-exploit RCE pivot) Bespoke install · alerting DSΣPDDCS [LLM] Known Shai-Hulud / Nx Console implant hash match (SHA256/SHA1) Bespoke install · hunting DSΣPDDCS [LLM] macOS LaunchAgent/LaunchDaemon plist persistence pointing at Python interpreter Bespoke install · hunting DSΣPDDCS [LLM] Compromised @cap-js stealer artefact hash present on disk or in execution Bespoke install · hunting DSΣPDDCS [LLM] VS Code/Cursor extension host fetches dropper from nrwl/nx orphan commit on GitHub Bespoke install · hunting DSΣPDDCS [LLM] macOS Python backdoor persistence via kitty-monitor LaunchAgent and cat.py drop Bespoke install · alerting DSΣPDDCS [LLM] Python backdoor self-daemonisation via __DAEMONIZED=1 spawned by VS Code helper or node Bespoke install · hunting DSΣPDDCS [LLM] TeamPCP rope.pyz Dropper Infection Markers on Linux Bespoke install · alerting DSΣPDDCS [LLM] 9router Node.js process spawning shell binary (CVE-2026-46339 post-exploit) Bespoke install · alerting DSΣPDDCS [LLM] SSH process spawned by Kopia invokes a shell child (ProxyCommand execution) Bespoke install · alerting DSPDDCS [LLM] Python process executing transformers.pyz dropped from git-tanstack.com (TeamPCP) Bespoke install · alerting DSΣPDDCS [LLM] Apache Camel JVM writing files to sensitive paths via camel-file (CVE-2026-47323 arbitrary file write) Bespoke install · hunting DSPDDCS [LLM] handler.lua dropped outside Algernon's configured web root (CVE-2026-45721 backdoor stage) Bespoke install · alerting DSΣPDDCS [LLM] On-disk presence of malicious @opensearch-project/opensearch payload SHA256 Bespoke install · hunting DSΣPDDCS [LLM] Postinstall script execution from compromised @opensearch-project/opensearch package Bespoke install · hunting DSΣPDDCS [LLM] bun runtime executed on CI runner spawning python3 with sudo escalation Bespoke install · alerting DSΣPDDCS [LLM] Compromised node-ipc.cjs bundle write (~117KB) under node_modules Bespoke install · alerting DSΣPDDCS [LLM] Mini Shai-Hulud Linux daemon persistence: kitty/cat.py and systemd user service Bespoke install · alerting DSΣPDDCS [LLM] mistralai 2.4.6 dropper: Python interpreter executing /tmp/transformers.pyz as detached session Bespoke install · alerting DSΣPDDCS [LLM] Drop of /tmp/transformers.pyz on Linux endpoint Bespoke install · alerting DSΣPDDCS [LLM] node-ipc stealer __ntw=1 environment marker in process command line Bespoke install · alerting DSΣPDDCS [LLM] Talos weekly top-prevalent malware hash watch (Coinminer / Injector / W32.Variant) Bespoke install · alerting DSΣPDD [LLM] Docker plugin runtime spawned from /var/lib/docker/plugins/ on host (CVE-2026-44848) Bespoke install · alerting DSΣPDDCS [LLM] Post-exploit RCE: node.js (n8n) spawning shell or scripting interpreter Bespoke install · alerting DSΣPDDCS [LLM] XenShell / Godzilla / Behinder JSP webshell file write on Cisco SD-WAN Manager Bespoke install · alerting DSΣPDDCS [LLM] AdaptixC2 'systemd-resolved' or Sliver 'CWan' implant on Linux / SD-WAN host Bespoke install · hunting DSΣPDDCS [LLM] TeamPCP Mini Shai-Hulud stealer payload hash match (SHA256/SHA1) Bespoke install · alerting DSΣPDDCS [LLM] Shai-Hulud npm preinstall: node spawns Bun runtime from bun-dl-* tmpdir Bespoke install · alerting DSΣPDD [LLM] Shai-Hulud AI coding-agent persistence: .claude/settings.json + .vscode/tasks.json drops Bespoke install · alerting DSPDD Article-specific behavioural hunt — elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub A Bespoke install · hunting DSP [LLM] Malicious elementary.pth dropped in Python site-packages Bespoke install · alerting DSΣPDDCS [LLM] Mini Shai-Hulud: Python subprocess spawns `_runtime/start.py` from lightning site-packages Bespoke install · alerting DSΣPDD [LLM] Mini Shai-Hulud PyPI payload known SHA256 (start.py / router_runtime.js) Bespoke install · alerting DSΣPDD [LLM] npm preinstall hook executes 'node setup.mjs' / 'bun execution.js' (Mini Shai-Hulud SAP supply chain) Bespoke install · alerting DSΣPDD [LLM] Mini Shai-Hulud known SHA256 IOC match (setup.mjs / execution.js / runner-memory dumper) Bespoke install · hunting DSΣPDD [LLM] Malicious tanstack npm postinstall hook executing postinstall.cjs Bespoke install · alerting DSΣPDDCS [LLM] Trinny marker file creation (.trinny-security-update) Bespoke install · alerting DSΣPDDCS [LLM] Hidden .fullgc cryptominer binary written to /ql/data/db/ Bespoke install · alerting DSΣPDDCS [LLM] Qinglong .fullgc cryptominer execution with nohup backgrounding Bespoke install · alerting DSΣPDDCS [LLM] Context.ai compromised Chrome extension installed on host (ID omddlmnhcofjbnbflmjginpjjblphbgk) Bespoke install · alerting DSΣPDDCS [LLM] Stage-2 implant masquerading as node-health-check daemon (/tmp/.kh, /tmp/.ns) Bespoke install · alerting DSΣPDD [LLM] npm/PyPI dropper self-cleanup: find rm -rf of kube-health-tools in node_modules Bespoke install · alerting DSΣPDD [LLM] launchctl persistence registering zsh.profiler service from non-admin location Bespoke install · alerting DSΣPDDCS [LLM] macOS file write of profiler binary to com.apple.Terminal masquerade path Bespoke install · alerting DSΣPDDCS [LLM] TeamPCP sysmon.py systemd-user persistence on developer host Bespoke install · alerting DSΣPDD [LLM] hackerbot-claw second-stage download: curl -sSfL pipe-bash from hackmoltrepeat.com/molt Bespoke install · alerting DSΣPDDCS [LLM] npm postinstall chain installs malicious 'openclaw' global package (cline@2.3.0 supply-chain IOC) Bespoke install · alerting DSΣPDDCS [LLM] OpenClaw persistence — launchd plist / systemd unit drop referencing 'openclaw' Bespoke install · alerting DSΣPDDCS [LLM] TeamPCP telnyx FetchAudio() — python subprocess running inline base64 exec Bespoke install · alerting DSΣPDDCS [LLM] Compromised litellm 1.82.7 / 1.82.8 PyPI install (TeamPCP supply-chain) Bespoke install · alerting DSΣPDDCS [LLM] litellm_init.pth Python autoload persistence drop Bespoke install · alerting DSΣPDDCS [LLM] Linux user-systemd sysmon persistence drop (~/.config/sysmon/sysmon.py + sysmon.service) Bespoke install · alerting DSΣPDDCS [LLM] Linux Python RAT orphaned via nohup python3 /tmp/ld.py (Axios npm payload) Bespoke install · alerting DSΣPDDCS [LLM] macOS Axios RAT daemon spoof + ad-hoc codesign of hidden /private/tmp binary Bespoke install · alerting DSΣPDDCS [LLM] axios RAT artifact dropped: com.apple.act.mond / wt.exe / ld.py with known SHA256 Bespoke install · alerting DSΣPDD [LLM] Malicious litellm_init.pth dropped to site-packages by pip (litellm==1.82.8 install artifact) Bespoke install · alerting DSΣPDDCS [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) Bespoke install · alerting DSΣPDDCS [LLM] TeamPCP systemd backdoor — sysmon.py / sysmon.service persistence on CI runner Bespoke install · alerting DSΣPDD [LLM] Compromised trivy binary (v0.69.4-v0.69.6) execution by SHA1 hash Bespoke install · alerting DSΣPDD [LLM] npm postinstall SSH-backdoor chain: node spawning sudo ufw allow 22/tcp + chown ~/.ssh Bespoke install · alerting DSΣPDD [LLM] ForceMemo: Node.js v22.9.0 spawned by Python from user home directory Bespoke install · alerting DSΣPDD [LLM] ForceMemo: init.json persistence file or i.js loader dropped by Python in user home root Bespoke install · hunting DSΣPDD [LLM] Python .pth startup hook executes subprocess to curl C2 (litellm fork-bomb pattern) Bespoke install · alerting DSΣPDDCS [LLM] CanisterWorm persistence: pglog/pg_state/internal-monitor systemd unit and /tmp/pglog drop Bespoke install · alerting DSΣPDDCS [LLM] Cacheract memdump.py download/execution on CI runner or developer host Bespoke install · alerting DSΣPDD [LLM] Storybook WebSocket XSS/RCE — malicious .stories file written to src/stories (CVE-2026-27148) Bespoke install · alerting DSΣPDDCS [LLM] Secondary payload install: 'npm install -g openclaw' postinstall hook execution Bespoke install · alerting DSΣPDDCS [LLM] Installation of sidoraress malicious npm packages (json-bigint-extend/jsonfb/jsonfx) Bespoke install · alerting DSΣPDD [LLM] s1ngularity Nx postinstall — `gh auth token` spawned by node/npm on CI runner Bespoke install · alerting DSΣPDDCS [LLM] SKILL.md written to ~/.claude/skills/ or ~/.openclaw/skills/ (agent-skill install) Bespoke install · hunting DSΣPDDCS [LLM] File creation under npx cache for Aikido-claimed phantom package names Bespoke install · alerting DSΣPDD [LLM] Python parent spawns detached 'python3 -' child reading payload from stdin Bespoke install · alerting DSΣPDDCS [LLM] npm/yarn/pnpm/bun lifecycle hook spawning shell or network LOLBin Bespoke install · hunting DSΣPDDCS [LLM] Sha1-Hulud npm Worm — Egress to bun.sh / oss.trufflehog.org / keychecker.trufflesecurity.com from npm/node context Bespoke install · alerting DSΣPDD [LLM] Sha1-Hulud npm Worm — Self-Hosted GitHub Actions Runner Registration with Name 'SHA1HULUD' Bespoke install · alerting DSΣPDD [LLM] Sha1-Hulud npm Worm — Drop of setup_bun.js / bun_environment.js / discussion.yaml by node or shell Bespoke install · hunting DSΣPDD [LLM] Bun/Node executing the Sha1-Hulud worm payload (setup_bun.js / bun_environment.js) Bespoke install · alerting DSΣPDDCS [LLM] Sha1-Hulud self-hosted GitHub Actions runner deployed under ~/.dev-env (SHA1HULUD) Bespoke install · alerting DSΣPDDCS [LLM] SHA1-Hulud worm payload execution via npm preinstall (setup_bun.js / bun_environment.js) Bespoke install · alerting DSΣPDDCS [LLM] Malicious '.github/workflows/discussion.yaml' workflow file created by npm/node Bespoke install · alerting DSΣPDDCS [LLM] Execution / write of ESET APT Q2-Q3 2025 known-bad SHA256 payload Bespoke install · hunting DSΣPDDCS [LLM] Installation or presence of malicious postmark-mcp npm package (v1.0.16+) Bespoke install · alerting DSΣPDDCS [LLM] s1ngularity nx: node modifies ~/.bashrc or ~/.zshrc to inject `sudo shutdown -h 0` Bespoke install · alerting DSΣPDD [LLM] GhostAction malicious workflow file added with curl POST to Plesk infrastructure Bespoke install · alerting DSΣPDDCS [LLM] Shai-Hulud bundle.js postinstall payload by known SHA256 hash Bespoke install · hunting DSΣPDDCS [LLM] Shai-Hulud persistence artifact: shai-hulud-workflow.yml file dropped on disk Bespoke install · alerting DSΣPDDCS [LLM] Install / lockfile mention of the 28 compromised Qix-campaign package@versions Bespoke install · hunting DSΣPDDCS [LLM] wdavdaemon or MDE Linux endpoints observed on CI/CD build runners Bespoke install · hunting DSΣPDD [LLM] Node/npm postinstall spawning AI coding agent CLI (s1ngularity execution chain) Bespoke install · alerting DSΣPDDCS [LLM] Scavenger loader/stealer SHA256 execution or drop on endpoint Bespoke install · alerting DSΣPDD [LLM] Installation of poisoned Ultralytics PyPI package (v8.3.41 / 8.3.42 / 8.3.45 / 8.3.46) Bespoke install · alerting DSΣPDDCS [LLM] cups-browsed writing new PPD or config under /etc/cups or /var/cache/cups Bespoke install · hunting DSΣPDDCS Article-specific behavioural hunt — Identifying insecure C Code with Valgrind and fixing with Snyk Code Bespoke install · hunting DSP [LLM] sshd loads compromised liblzma.so.5.6.0 / 5.6.1 (CVE-2024-3094 runtime trigger) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Code injection in Python: examples and prevention Bespoke install · hunting DSP Article-specific behavioural hunt — High severity vulnerability found in libcurl and curl (CVE-2023-38545) Bespoke install · hunting DSP

Command & Control (75)

[WEEKLY] Script Interpreter or Package-Install Hook Egress to Free-Tier Edge SaaS Within 5 Minutes of Process Start Internal c2 · alerting DSΣPDD [LLM] SOCKS5 proxy masquerading as 'smbd -D' from non-Samba install path Bespoke c2 · alerting DSΣPDDCS [LLM] GS-Netcat reverse shell — host beacons to gs.thc.org Global Socket relay Bespoke c2 · alerting DSΣPDDCS [LLM] splunkd spawning reverse-shell or interactive interpreter (post-CVE-2026-20253 exploitation) Bespoke c2 · alerting DSPDDCS [LLM] AUR build process egress to temp.sh or github.com/fardewoak/nodejs-argo Bespoke c2 · alerting DSΣPDDCS [LLM] Atomic Arch: non-Tor-aware process connecting to local SOCKS proxy on 9050/9150 Bespoke c2 · hunting DSΣPDDCS [LLM] Atomic Arch — DNS resolution and HTTP POST to temp.sh from non-browser developer workstation process Bespoke c2 · alerting DSΣPDDCS [LLM] Atomic Arch — Tor client spawn or .onion endpoint contact from AUR-installing developer host Bespoke c2 · alerting DSΣPDDCS [LLM] Miasma worm GitHub commit-search C2 magic strings on command line or script Bespoke c2 · alerting DSΣPDDCS [LLM] Network egress to OceanLotus SPECTRALVIPER C2 IPs (2024-2026 campaigns) Bespoke c2 · hunting DSΣPDDCS [LLM] DNS resolution for OceanLotus SPECTRALVIPER C2 domains Bespoke c2 · alerting DSΣPDDCS [LLM] Sustained low-volume beaconing to OceanLotus SPECTRALVIPER C2 (long-tail persistence) Bespoke c2 · hunting DSPDDCS [LLM] Internal host outbound to CVE-2026-50751 Qilin actor IPs (post-bypass C2 / staging) Bespoke c2 · alerting DSΣPDDCSCW [LLM] Outbound endpoint connections to BRICKSTORM C2 IP 149.248.11.71 Bespoke c2 · hunting DSΣPDDCSCW [LLM] GitHub Actions runner: node from Claude Code Action egresses to non-Anthropic/non-GitHub endpoint Bespoke c2 · hunting DSPDDCS [LLM] Package manager runtime connecting to durabletask/axios supply-chain C2 IOCs Bespoke c2 · alerting DSΣPDDCS [LLM] Egress to typosquatted C2 flipboxstudio.info (Laravel-Lang Composer SC) Bespoke c2 · alerting DSΣPDDCS [LLM] TeamPCP Checkmarx KICS supply-chain stealer C2 callback (audit.checkmarx.cx / 94.154.172.43) Bespoke c2 · hunting DSΣPDDCS [LLM] C2 callback to moika.tech payload distribution infrastructure Bespoke c2 · alerting DSΣPDDCS [LLM] Container egress to cryptominer pool / Kinsing C2 Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound HTTP beacon to vpmdhaj C2 (aab.sportsontheweb.net) Bespoke c2 · alerting DSΣPDDCS [LLM] Cyberhaven trojanized Chrome extension C2 callback to cyberhavenext.pro Bespoke c2 · alerting DSΣPDDCS [LLM] Yamcs Java process beacons to webhook / interact / tunneling service (CVE-2026-46621 C2) Bespoke c2 · alerting DSΣPDDCS [LLM] Reverse-shell /dev/tcp file descriptor from Yamcs java process tree Bespoke c2 · alerting DSΣPDDCS [LLM] DNS/HTTPS exfil to sentry.anyclaw.store (Codex token C2 masquerading as Sentry) Bespoke c2 · alerting DSΣPDDCS [LLM] Laravel-Lang supply chain C2/exfil to flipboxstudio.info Bespoke c2 · alerting DSΣPDDCS [LLM] C2 egress to flipboxstudio.info from Laravel-Lang composer dropper Bespoke c2 · alerting DSΣPDDCS [LLM] Mini Shai-Hulud C2 callback to zero.masscan.cloud / 94.154.172.43 Bespoke c2 · alerting DSΣPDDCS [LLM] Reverse shell from 9router-spawned shell — outbound TCP from node-child bash Bespoke c2 · hunting DSPDDCS [LLM] Outbound connection to TeamPCP C2 IP 83.142.209.194 Bespoke c2 · hunting DSΣPDDCS [LLM] Mini Shai-Hulud / TeamPCP C2 beacon to api.masscan.cloud / git-tanstack.com / *.getsession.org Bespoke c2 · alerting DSPDDCS [LLM] Outbound network connection to mistralai 2.4.6 dropper C2 (83.142.209.194) Bespoke c2 · alerting DSΣPDDCS [LLM] DNS lookup for azurestaticprovider[.]net node-ipc exfil domain Bespoke c2 · alerting DSΣPDDCS [LLM] AdaptixC2 'shadowcore' / Mythic C2 traffic to UAT-8616 infrastructure 194.163.175.135 Bespoke c2 · hunting DSΣPDDCS [LLM] FrostyNeighbor C2 callout to needbinding/nebao/algsat/sardk/alexavegas/lavanille Bespoke c2 · alerting DSΣPDDCS [LLM] Mini Shai-Hulud npm Worm C2 callback to Session Protocol CDN and masscan.cloud Bespoke c2 · alerting DSΣPDDCS [LLM] Session/Oxen P2P exfil DNS or TCP to getsession.org from build/CI host Bespoke c2 · alerting DSΣPDD [LLM] CL-STA-1132 EarthWorm staging download from 146.70.100.69:8000/php_sess Bespoke c2 · hunting DSΣPDD [LLM] Outbound to elementary-data exfil C2 igotnofriendsonlineorirl-imgonnakmslmao.sky Bespoke c2 · alerting DSΣPDDCS [LLM] Exfil to skyhanni.cloud C2 with X-Rise-To-The-Trinny header Bespoke c2 · alerting DSΣPDDCS [LLM] GPT-Proxy backdoor C2 / Stage-2 download (sync.geeker.indevs.in, gibunxi4201/kube-node-diag) Bespoke c2 · alerting DSΣPDD [LLM] Outbound connection to Velora DEX npm supply-chain C2 89.36.224.5 Bespoke c2 · alerting DSΣPDDCS [LLM] TeamPCP Trivy/KICS C2 callback to scan.aquasecurtiy.org / 45.148.10.212 Bespoke c2 · hunting DSΣPDD [LLM] axios Supply Chain RAT C2 Callback to sfrclak.com (Port 8000) Bespoke c2 · alerting DSΣPDDCS [LLM] OpenClaw Gateway WebSocket listener / loopback connection on TCP 18789 Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound C2 to sfrclak.com / 142.11.206.73:8000 (Axios npm RAT beacon) Bespoke c2 · alerting DSΣPDDCS [LLM] axios npm RAT C2 beacon to sfrclak.com / 142.11.206.73:8000 Bespoke c2 · hunting DSΣPDD [LLM] Outbound DNS/HTTPS to TeamPCP exfil domain models.litellm.cloud (litellm PyPI compromise) Bespoke c2 · alerting DSΣPDDCS [LLM] TeamPCP C2 egress to 83.142.209.203:8080 (telnyx WAV-stego dropper) Bespoke c2 · hunting DSΣPDDCS [LLM] TeamPCP supply-chain C2 — outbound to checkmarx[.]zone / 83.142.209.11 Bespoke c2 · hunting DSΣPDD [LLM] Trivy supply-chain C2 beacon to typosquat domain scan.aquasecurtiy.org Bespoke c2 · alerting DSΣPDD [LLM] bittensor-wallet 4.0.2 backdoor C2 domain contact (opentensor-* lookalikes) Bespoke c2 · alerting DSΣPDD [LLM] DNS tunneling exfiltration pattern to *.t.opentensor-cdn.com (hex chunk/index/total/session) Bespoke c2 · alerting DSΣPDD [LLM] C2 beaconing to Vercel-hosted Cloudflare-impersonating domains (cloudflareguard / cloudflareinsights) Bespoke c2 · alerting DSΣPDD [LLM] ForceMemo: Python process queries Solana mainnet RPC endpoint (blockchain dead-drop C2) Bespoke c2 · alerting DSΣPDD [LLM] Outbound C2 callback to xygeni-action backdoor IP 91.214.78.178 from CI runner Bespoke c2 · hunting DSΣPDDCS [LLM] Bash-spawned curl to xygeni-action C2 nip.io endpoint with /b/in /b/q /b/r path on CI runner Bespoke c2 · alerting DSΣPDDCS [LLM] GlassWorm hardcoded C2 IP egress (45.32.150.251 / 217.69.3.152) for Stage-2 fetch and exfil Bespoke c2 · hunting DSΣPDDCS [LLM] GlassWorm Solana blockchain dead-drop C2 lookup via public RPC endpoints from Node Bespoke c2 · hunting DSΣPDDCS [LLM] Exfiltration to kubernetes-el attacker webhook.site UUIDs (Pwn Request payload) Bespoke c2 · alerting DSΣPDD [LLM] PromptSpy VNC C2 egress to 54.67.2.84 Bespoke c2 · hunting DSΣPDDCS [LLM] CI runner anomalous outbound to raw.githubusercontent.com / gist.githubusercontent.com Bespoke c2 · alerting DSPDDCS [LLM] Scavenger npm malware C2 beacon to firebase.su / dieorsuffer.com / smartscreen-api.com Bespoke c2 · alerting DSΣPDD [LLM] Endpoint contact with attacker C2 setup-service.com (OpenClaw skill stager) Bespoke c2 · alerting DSΣPDDCS [LLM] GhostChat C2/staging infrastructure contact (hitpak.org, buildthenations.info, fkclb.com) Bespoke c2 · alerting DSΣPDDCS [LLM] Aikido npm phishing: direct outbound connection to RackGenius C2 (163.123.236.118) Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound exfiltration to webhook.site from npm / node / bun process tree Bespoke c2 · alerting DSΣPDDCS [LLM] GhostAction C2 egress to Plesk-hosted exfiltration infrastructure Bespoke c2 · hunting DSΣPDDCS [LLM] Shai-Hulud worm C2 exfiltration to webhook.site UUID bb8ca5f6 Bespoke c2 · alerting DSΣPDDCS [LLM] CI/CD Linux build host outbound to gist.githubusercontent.com (tj-actions IOC pattern) Bespoke c2 · alerting DSΣPDD [LLM] CI/CD runner outbound to gist.githubusercontent.com (tj-actions CVE-2025-30066 staging fetch) Bespoke c2 · alerting DSΣPDDCS [LLM] Scavenger C2 callback: ifyouseethisyouareultragay[.]com / pokerainteasy[.]su Bespoke c2 · alerting DSΣPDD [LLM] Egress to Solidity Language Cursor extension C2 infrastructure (angelic.su / lmfao.su / staketree.net / ab498.pythonanywhere.com / 144.172.1 Bespoke c2 · hunting DSΣPDDCS [LLM] BoltDB Go backdoor C2 callback to 49.12.198.231:20022 Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound fetch of file.sh via attacker-controlled commit d8daa0b... on raw.githubusercontent.com Bespoke c2 · alerting DSΣPDDCS

Actions on Objectives (144)

[WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSPDD [WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request Internal actions · alerting DSPDD [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] npm-install spawned process performing cred-file fan-out plus IMDS reach Internal actions · alerting DSPDDCSCW [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Internal actions · alerting DSPDD Linux Add Files In Known Crontab Directories ESCU actions · hunting P Linux Auditd At Application Execution ESCU actions · hunting P Linux Auditd Copy Fail Privilege Escalation ESCU actions · alerting P Linux Auditd Edit Cron Table Parameter ESCU actions · hunting P Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File ESCU actions · hunting P Linux Auditd Service Restarted ESCU actions · hunting P Linux Auditd Service Started ESCU actions · hunting P Linux Common Process For Elevation Control ESCU actions · hunting P Linux Deleting Critical Directory Using RM Command ESCU actions · alerting P Linux Deletion Of Cron Jobs ESCU actions · hunting P Linux Disable Services ESCU actions · alerting P Linux Docker Shell Execution ESCU actions · hunting P Linux Indicator Removal Clear Cache ESCU actions · alerting P Linux Iptables Firewall Modification ESCU actions · hunting P Linux Kworker Process In Writable Process Path ESCU actions · hunting P Linux Magic SysRq Key Abuse ESCU actions · alerting P Linux Medusa Rootkit ESCU actions · alerting P Linux Possible Access To Credential Files ESCU actions · hunting P Linux Possible Append Cronjob Entry on Existing Cronjob File ESCU actions · hunting P Linux Possible Cronjob Modification With Editor ESCU actions · hunting P Linux Service File Created In Systemd Directory ESCU actions · hunting P Linux Service Restarted ESCU actions · hunting P Linux Service Started Or Enabled ESCU actions · hunting P Linux Stop Services ESCU actions · alerting P Linux System Reboot Via System Request Key ESCU actions · alerting P Linux Unix Shell Enable All SysRq Functions ESCU actions · hunting P MacOS Keychains Dumped ESCU actions · alerting P MacOS plutil ESCU actions · alerting P [LLM] Velvet Ant air-gap bridge — fcgiwrap/uptime spawning SSH from HTTP-driven FastCGI Bespoke actions · alerting DSΣPDDCS [LLM] Non-browser process fan-out reading SSH/npm/Docker/AWS/browser credential stores on Arch host Bespoke actions · hunting DSPDDCS [LLM] Anti-forensic deletion/tampering of macOS Tahoe 26 App.MenuItem Biome stream Bespoke actions · alerting DSΣPDDCS [LLM] Atomic Arch: outbound HTTP upload to temp.sh from developer/build host Bespoke actions · alerting DSΣPDDCS [LLM] sshd writing to non-standard files (credential-capture log artifact) Bespoke actions · hunting DSPDDCS [LLM] Atomic Arch infostealer — bulk reads of SSH/npmrc/Vault/browser-cookie files by non-shell process Bespoke actions · hunting DSPDDCS [LLM] Agentjacking C2/exfiltration to advisory-tracker.com (Tenet Sentry-MCP attack) Bespoke actions · alerting DSΣPDDCS [LLM] File writes to sensitive paths by LangGraph Python/Node runtime Bespoke actions · hunting DSΣPDDCS [LLM] High-volume scripted access to Tchap Matrix endpoint (bulk public-room scraping) Bespoke actions · hunting DSPDDCS [LLM] ShinyHunters ransom marker file — README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in PeopleSoft directories Bespoke actions · alerting DSΣPDDCS [LLM] PeopleSoft lateral-movement script — *_fanout.sh execution and zstd compression chain Bespoke actions · hunting DSΣPDDCS [LLM] Outbound SMB 445 from PeopleSoft host — NetNTLM hash capture Bespoke actions · alerting DSΣPDDCS [LLM] meta-ads-mcp Streamable HTTP listener bound to non-loopback interface Bespoke actions · alerting DSΣPDDCS [LLM] Vulnerable Baileys npm package present on disk (CVE-2026-48063) Bespoke actions · hunting DSΣPDDCS [LLM] Baileys messages.upsert event carrying a requestId field (exploit signature) Bespoke actions · alerting SPDD [LLM] Cross-platform memory scraping of GitHub Actions Runner.Worker process Bespoke actions · hunting DSPDDCS [LLM] Bun runtime reading developer credential files (.npmrc / .pypirc / .ssh / .env / cloud configs) Bespoke actions · alerting DSPDDCS [LLM] gh-token-monitor service install or rm -rf wiper command (Hades self-destruct) Bespoke actions · alerting DSΣPDDCS [LLM] Rclone exfiltration from Check Point VPN gateway or post-bypass internal host Bespoke actions · hunting DSΣPDDCSCW [LLM] Mini Shai-Hulud npm worm exfiltration to t.m-kosche.com OpenTelemetry endpoint Bespoke actions · alerting DSΣPDDCS [LLM] Cloud/SSH/npm credential file access by Node or Bun during npm install Bespoke actions · hunting DSPDDCS [LLM] GitHub Actions Runner.Worker process-memory secret scraping (Miasma payload) Bespoke actions · alerting DSΣPDDCS [LLM] Cloud IMDS credential harvesting from node/bun process on CI runner Bespoke actions · alerting DSΣPDDCSCW [LLM] Destructive 'rm -rf ~' or Miasma honeytoken tripwire from node/bun process tree Bespoke actions · alerting DSΣPDDCS [LLM] Lateral movement via aws ssm send-command or kubectl exec spawned by python/node Bespoke actions · alerting DSΣPDDCSCW [LLM] Cloud credential file access by node/python runtime Bespoke actions · hunting DSΣPDDCS [LLM] Locale-conditional rm -rf wiper command from python/node runtime Bespoke actions · alerting DSΣPDDCS [LLM] Process reading /proc/<pid>/mem of GitHub Actions Runner.Worker (in-memory secret extraction) Bespoke actions · alerting DSΣPDDCS [LLM] Orphaned process (ppid=1) executing from /tmp hidden hex path (post-dropper stage-2) Bespoke actions · alerting DSΣPDDCS [LLM] AWS IMDS (169.254.169.254) Hit from Developer / Non-EC2 Endpoint (Nx Console Credential Theft) Bespoke actions · hunting DSPDDCS [LLM] AI coding agent bulk-deleting JUnit test files after jqwik resolution Bespoke actions · alerting DSPDDCS [LLM] Kubernetes API curl/wget with ServiceAccount token from container Bespoke actions · alerting DSΣPDDCSCW [LLM] PraisonAI python process spawning shell, curl, or wget (post-exploitation tool-use abuse) Bespoke actions · alerting DSΣPDDCS [LLM] Vulnerable vm2 package (<=3.11.3) present on host — CVE-2026-47137 exposure surface Bespoke actions · hunting DSΣPDDCS [LLM] Container default credential leak — PKP_DB_PASSWORD=changeMePlease and --secret Bespoke actions · hunting DSΣPDDCS [LLM] Container-to-container horizontal scan — Dero miner self-propagation Bespoke actions · alerting DSPDDCS [LLM] Mini Shai-Hulud npm worm exfil to filev2.getsession.org Bespoke actions · alerting DSPDDCS [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] Non-Codex-CLI node process reading ~/.codex/auth.json (Codex OAuth credential theft) Bespoke actions · alerting DSΣPDDCS [LLM] nezha-agent spawning credential-access shell commands on Linux (post-RCE) Bespoke actions · alerting DSΣPDDCS [LLM] nezha-agent outbound network connection to cloud instance-metadata service Bespoke actions · alerting DSΣPDDCS [LLM] Megalodon harvester: curl POST to C2 /collect endpoint on Linux runner Bespoke actions · alerting DSΣPDDCS [LLM] Megalodon harvester: bash secret-grep across workspace (API_KEY|SECRET|TOKEN|PRIVATE_KEY|BEGIN RSA) Bespoke actions · hunting DSΣPDDCS [LLM] Megalodon harvester: clustered read of ~/.ssh/id_*, ~/.kube/config, ~/.npmrc, ~/.docker/config.json in one session Bespoke actions · hunting DSPDDCS [LLM] Developer credential store read by Python or Node spawned from VS Code (Nx Console stealer pattern) Bespoke actions · hunting DSPDDCS [LLM] VS Code extension host fan-out reads of developer secrets (.ssh, .aws, .npmrc, ~/.claude/settings.json) Bespoke actions · hunting DSPDDCS [LLM] Python Process Reading Multi-Cloud Credential Stores (durabletask Stealer Stage) Bespoke actions · hunting DSPDDCS [LLM] GitHub Actions Runner.Worker process-memory secret scraping via /proc Bespoke actions · hunting DSΣPDDCS [LLM] python3 reading /proc/<PID>/mem to scrape Runner.Worker secrets Bespoke actions · alerting DSΣPDDCS [LLM] Outbound connection to Gremlin Stealer exfiltration host 194.87.92.109 Bespoke actions · hunting DSΣPDDCS [LLM] Outbound egress to node-ipc stealer infrastructure (azurestaticprovider[.]net / 37.16.75.69) Bespoke actions · alerting DSΣPDDCS [LLM] node.js process staging credential dump in nt-* temp directory Bespoke actions · hunting DSΣPDDCS [LLM] Vulnerable vm2 npm package (<= 3.11.2) present on host — CVE-2026-45411 Bespoke actions · hunting DSΣPDDCS [LLM] Container escape via chroot/nsenter against mounted host filesystem Bespoke actions · alerting DSΣPDDCS [LLM] UAT-8616 post-compromise on SD-WAN: SSH key add, NETCONF edit, su root, XMRig miner.sh Bespoke actions · alerting DSPDDCS [LLM] Mini Shai-Hulud dead-drop git commit authored as claude@users.noreply.github.com Bespoke actions · alerting DSΣPDDCS [LLM] Node/npm/Bun process enumerating cloud, wallet, AI, and messaging credential file paths Bespoke actions · hunting DSPDDCS [LLM] Stage-3 exfil archive trin.tar.gz POST via curl --data-binary Bespoke actions · alerting DSΣPDDCS [LLM] Mini Shai-Hulud: Bun runtime executing `router_runtime.js` (2nd-stage stealer) Bespoke actions · alerting DSΣPDD [LLM] Svix Ingest webhook exfiltration relay (src_3387PLMB2uhXOBe3Q8sHu) Bespoke actions · alerting DSΣPDDCS [LLM] Node.js postinstall reading .env / .env.* during package install Bespoke actions · alerting DSPDDCS [LLM] Java/Tomcat process spawns OS command interpreter (post-Thymeleaf SSTI RCE) Bespoke actions · alerting DSΣPDDCS [LLM] Credential archive staging — trin.tar.gz created by python process Bespoke actions · alerting DSΣPDDCS [LLM] Read of /proc/<pid>/mem targeting GitHub Runner.Worker (TeamPCP credential dump) Bespoke actions · alerting DSΣPDD [LLM] plain-crypto-js setup.js self-deletion or package.json overwrite (anti-forensics) Bespoke actions · hunting DSΣPDDCS [LLM] hackerbot-claw token exfiltration: curl POST with GITHUB_TOKEN to recv.hackmoltrepeat.com Bespoke actions · alerting DSΣPDDCS [LLM] Access to OpenClaw credential store (~/.openclaw/credentials/, ~/.openclaw/config.json5) Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP exfiltration archive tpcp.tar.gz created on disk Bespoke actions · alerting DSΣPDDCS [LLM] Python process spawning shell with TeamPCP recon chain (hostname; whoami; uname; ip addr fallback) Bespoke actions · alerting DSΣPDDCS [LLM] Python process contacting AWS IMDS 169.254.169.254 (litellm stealer IAM credential theft) Bespoke actions · alerting DSΣPDDCS [LLM] In-cluster Kubernetes secret enumeration with Python user-agent (litellm stealer K8s pivot) Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP exfiltration archive — tpcp.tar.gz file creation on host Bespoke actions · alerting DSΣPDD [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem Bespoke actions · hunting DSPDD [LLM] Exfil staging artefacts: session.key, payload.enc, session.key.enc, tpcp.tar.gz in temp Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP Linux credential harvest: Python reading /etc/shadow + auth.log + cloud Bespoke actions · hunting DSPDDCS [LLM] Host-root mount wiper: chroot /mnt/host reboot -f or rm -rf / --no-preserve-root Bespoke actions · alerting DSΣPDDCS [LLM] Compromised kubernetes.el destructive payload — Emacs spawning `rm -rf / --no-preserve-root` Bespoke actions · alerting DSΣPDD [LLM] Outbound traffic to *.oastify.com (BurpSuite Collaborator) from corporate endpoint Bespoke actions · alerting DSΣPDDCS [LLM] npm install referencing GitHub commit SHA (github:owner/repo#sha) — dangling-commit supply chain hunt Bespoke actions · hunting DSΣPDDCS [LLM] AI CLI weaponized for recon — claude/gemini/q invoked under npm install lineage Bespoke actions · alerting DSΣPDDCS [LLM] s1ngularity collection artifact — `/tmp/inventory.txt` written by node/npm on runner Bespoke actions · alerting DSΣPDDCS [LLM] GitHub Actions runner — process reads runner worker memory to extract GITHUB_TOKEN Bespoke actions · hunting DSΣPDDCS [LLM] tj-actions/changed-files compromise: memdump.py secret-exfiltration shell pattern on runner (CVE-2025-30066) Bespoke actions · alerting DSΣPDD [LLM] SKILL.md file written referencing fabricated openclaw-core prerequisite (ClawHub skill social engineering hook) Bespoke actions · hunting DSPDDCS [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets Bespoke actions · alerting DSΣPDDCS [LLM] AI agent process reads cloud-credential, SSH or dotenv files (skill credential theft) Bespoke actions · hunting DSPDDCS [LLM] Prompt-injection markers (base64, Unicode tags, 'ignore previous instructions') in SKILL.md content Bespoke actions · hunting DSPDDCS [LLM] GhostChat C2 beacon URL pattern: hitpak.org/page.php?tynor=<host>sss<user> Bespoke actions · alerting DSΣPDDCS [LLM] tj-actions/changed-files compromised commit SHA referenced in workflow YAML or git history Bespoke actions · alerting DSΣPDDCS [LLM] Nx s1ngularity-repository creation via GitHub API from developer or CI endpoint Bespoke actions · alerting DSΣPDDCS [LLM] AI CLI tool (claude/gemini/q) spawned non-interactively by node/npm/npx for recon Bespoke actions · alerting DSΣPDDCS [LLM] Bun/Node bursty PUT to api.github.com /contents from infected host (Sha1-Hulud exfil) Bespoke actions · alerting DSPDDCS [LLM] TruffleHog secret-scanner execution on developer / CI host (SHA1-Hulud credential harvest) Bespoke actions · alerting DSΣPDDCS [LLM] Cloud metadata service (IMDS) access from npm / node child process Bespoke actions · alerting DSPDDCS [LLM] SHA1-Hulud wiper: mass deletion of user home directory by npm/node descendant Bespoke actions · alerting DSPDDCS [LLM] TruffleHog spawned by node/npm as postinstall — Shai-Hulud credential sweep Bespoke actions · alerting DSΣPDD [LLM] s1ngularity nx: AI CLI assistant invoked with permission-bypass flags (Claude/Gemini/Q) Bespoke actions · alerting DSΣPDD [LLM] s1ngularity nx: /tmp/inventory.txt staging file created on host Bespoke actions · alerting DSΣPDD [LLM] GhostAction curl/wget POST of CI/CD secret token to Plesk endpoint Bespoke actions · alerting DSΣPDDCS [LLM] TruffleHog secret-scanner executed by node/npm postinstall context Bespoke actions · alerting DSΣPDDCS [LLM] Postinstall node child enumerating multiple developer credential stores Bespoke actions · hunting DSPDDCS [LLM] AI coding agent CLI (claude/gemini/q) invoked with permission-bypass flags Bespoke actions · alerting DSΣPDDCS [LLM] Nx s1ngularity inventory file written to /tmp (inventory.txt / inventory.txt.bak) Bespoke actions · alerting DSΣPDDCS [LLM] Node process creating GitHub repo via api.github.com (s1ngularity exfil channel) Bespoke actions · hunting DSPDDCS [LLM] Runner.Worker process memory dump via memdump.py on CI/CD runner (tj-actions credential theft) Bespoke actions · alerting DSΣPDDCS [LLM] Linux process opens /proc/<pid>/mem or /proc/<pid>/maps on a build/CI host (CVE-2025-8217 / CVE-2025-30066 memory dump TTP) Bespoke actions · alerting DSΣPDD [LLM] Runner.Worker process memory dumped via /proc/PID/mem read on Linux runner Bespoke actions · alerting DSΣPDDCS [LLM] Git checkout of compromised tj-actions/changed-files commit on runner host Bespoke actions · hunting DSPDDCS [LLM] HTTP/2 server crash-loop on internet-facing host (CONTINUATION flood DoS exploitation signal) Bespoke actions · alerting DSPDDCS [LLM] Tomcat/Java process spawns OS shell or LOLBin (post-webshell RCE) Bespoke actions · alerting DSΣPDDCS [LLM] Container PID 1 environment harvest via /proc/1/environ read Bespoke actions · hunting DSΣPDDCS

Recent articles citing Linux-targeted detections

crit Chinese hackers hijack auth flow, spy on isolated network for a decade
crit Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security
crit Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
high Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
crit China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
high Over 400 Arch Linux packages compromised to push rootkit, infostealer
high Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
crit LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution
high CISA orders feds to patch actively exploited Ivanti flaw by Sunday
med Over 73,000 French govt employees affected in Tchap messenger breach
crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
crit [GHSA / CRITICAL] CVE-2026-48039: Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
crit Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories
crit OceanLotus: From external espionage to domestic targeting
crit [GHSA / CRITICAL] CVE-2026-48063: Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted pr
crit China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
crit Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
crit [GHSA / CRITICAL] CVE-2026-48031: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
crit Compromised Rust crate onering performs code exfiltration
crit [GHSA / CRITICAL] CVE-2026-48030: Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
crit [GHSA / CRITICAL] CVE-2026-8467: PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook pl
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System
crit New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing
high Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer
crit LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
crit [GHSA / CRITICAL] CVE-2026-47724: nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
crit [GHSA / CRITICAL] CVE-2026-47252: Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
crit [GHSA / CRITICAL] CVE-2026-45034: PHPSpreadsheet has a patch bypass for CVE-2026-34084
crit One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
crit Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order
crit VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
crit [GHSA / CRITICAL] CVE-2026-47731: NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over th
high Securing CI/CD in an agentic world: Claude Code Github action case
crit [GHSA / CRITICAL] CVE-2026-47670: Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
crit [GHSA / CRITICAL] CVE-2026-47669: DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
crit [GHSA / CRITICAL] CVE-2026-47668: DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
crit [GHSA / CRITICAL] GHSA-jpvj-wpmj-h7rv: Supply chain compromise via malicious @cap-js/openapi
crit [GHSA / CRITICAL] CVE-2026-44181: Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execut
crit [GHSA / CRITICAL] CVE-2026-44180: Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
crit Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
high Why EDR and proxy won’t save you from supply chain malware
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)
high Multiple redhat-cloud-services npm Packages compromised
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
high Nx Console VS Code Extension Compromised
high Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
crit Containers on fire: from container escapes to supply chain attacks
crit Malicious npm packages abuse dependency confusion to profile developer environments
crit [GHSA / CRITICAL] CVE-2026-47410: praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery f
crit [GHSA / CRITICAL] CVE-2026-47391: PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
crit [GHSA / CRITICAL] CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subpro
crit [GHSA / CRITICAL] CVE-2026-47393: PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
crit [GHSA / CRITICAL] CVE-2026-47137: vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
crit What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant
high Typosquatted npm packages used to steal cloud and CI/CD secrets
high What MDM can't protect on developer machines (and what to do about it)
crit [GHSA / CRITICAL] CVE-2026-46621: Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
crit [GHSA / CRITICAL] CVE-2026-46562: Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override