🎯 User Execution

The items that name it 9

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Victims downloaded and executed a masqueraded MSP360 installer distributed under deceptive filenames resembling legitimate business documents and software.

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12

  Victim installs malicious extension enabling collection to run

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12It is written here as User Execution: Malicious Link.

  Extension opens a Telegram bot deep link with referral code on first install

• Socket: Operation Muck and Load
  writeup2026-07-16It is written here as User Execution: Malicious File.

  Victims induced to clone/build/run the malicious Go module or lure repositories.

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30

  Relies on users installing and continuing to use the extension believing it protects their privacy.

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01It is written here as User Execution: Malicious File.

  Victim instructed to install the poisoned dev branch/package version as part of a fake job interview or developer task lure

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29It is written here as User Execution: Malicious Library.

  Developers install and instantiate the malicious Sicoob.Sdk library believing it to be an official SDK

• BufferZoneCorp Malicious Gems & Go Modules
  writeup2026-05-06It is written here as User Execution: Malicious Library.
• MITRE ATLAS v2026.09 data release
  repoIt is written here as User Execution: Unsafe AI Artifacts.

  Updated technique (v2026.07)