Search for a command to run...
Series
Technical security write-ups covering malware, abuse, impersonation, supply-chain risks, and real-world trust boundary failures.
A major international takedown disrupted hundreds of systems. The StealC infrastructure I documented still answers on its known malware routes.
I reported the listenKey issue in December 2024. Thirteen days of recent supply-chain findings pushed me to re-test it — and the vulnerability now appears closed after being rejected as “Social Engineering.”
A near-identical clone of my Binance WebSocket library had no payload — but it spoofed identity, shadowed the import path, linked to a 404 repo, and came from the same account as pybotnet.
A fake recruiter tried to turn VSCode workspace trust into silent code execution. Here is the attack chain, the infrastructure, and the IOCs.
How 19 fake GitHub repositories across 17 accounts led from a Python dropper to a StealC-linked payload chain.
Update (2026-04-22, 13:33): I submitted this case to GitHub Support for campaign-level review. Ticket ID: 4313391. Further update (2026-04-23): I published a deeper technical follow-up covering the
