🎯 T1105 Ingress Tool Transfer

The items that name it 3

• Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
  writeup2026-10-27It is written here as T1105 Ingress Tool Transfer: runtime fetch of a second-stage stealer from phantom[.]bonto[.]io/config.
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeup2026-10-23It is written here as T1105 Ingress Tool Transfer: /codepy retrieval, not confirmed.
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeup2026-10-21It is written here as T1105 - Ingress Tool Transfer (loader downloads Python from http://<domain>/codepy and runs it with exec, no signature or hash check).

  loader downloads Python from http://<domain>/codepy and runs it with exec, no signature or hash check