🎯 Ingress Tool Transfer

The items that name it 9

• Plex vulnerabilities being exploited in the wild to drop a cryptominer
  writeup2026-10-19It is written here as Ingress tool transfer: files 'docker' and 'x' downloaded from 217.60.194.116 after exploitation.
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeup2026-10-02

  Downloading threat actor-controlled content (temp_batch.cmd) and dynamically resolved second-stage payloads

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  MSP360 downloaded ScreenConnect; ScreenConnect subsequently used to transfer and execute additional tooling on compromised endpoints.

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeup2026-09-20

  Multi-stage retrieval of additional JavaScript and Python payloads (/$/boot, /$/1, /0x/js) via blockchain-pointed and HTTP downloads.

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Downloading architecture-specific Linux payloads via curl/wget from C2 server 43.228.157.68.

• Socket: Operation Muck and Load
  writeup2026-07-16

  Invoke-WebRequest used to download staged content and payload archives from remote infrastructure.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15

  Downloader fetches and executes pepesoft.exe from remote hosting

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01

  Loader retrieves and decrypts remote JavaScript payloads (first and second stage) for execution

• Zero-Click RCE in MCP
  writeup2026-05-06

  Prompt injection instructs Cursor to fetch the remote payload from the GitHub Gist