x.comthreadVictor (@VMG_CU) on X
A social post summarising Elastic's REF8801 campaign. A fake startup accelerator offered founders free Claude/Gemini credits plus a coding agent. The agent was a repackaged open-source project that set OPENROUTER_BASE_URL to an attacker-controlled endpoint and added its own MCP server, so victims' prompts and code went to the attacker. It shows how a trojanised AI coding agent can hijack the LLM base URL and add an MCP server for exfiltration.
TL;DR Elastic REF8801: a fake accelerator lured founders with free LLM credits and a trojanised open-source coding agent that rerouted OPENROUTER_BASE_URL and added a rogue MCP server.
Organisations named here
- Elastic Security Labs
- OPENROUTER_BASE_URL
- REF8801
Technologies named here
- Claude
- Repackaged open-source coding agent
- Gemini
- Attacker-controlled MCP server
- OpenRouter
- MCP server added by attacker
- Model Context Protocol
Techniques named here
- Trojanized/repackaged open-source software
Threat actors named here
- Elastic REF8801
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup