🎯 Data from Local System

The items that name it 6

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Additional tooling delivered through ScreenConnect used to collect information from victim devices.

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12

  Collector reads localStorage entries such as padreV2-session, padreV2-stamper, padre-v2-bundles-store-v2, sBundles, eBundles

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Collection of local credential and configuration data from compromised servers and runners.

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29

  Package reads the PFX file from local disk via File.ReadAllBytes

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07

  Harvesting of Documents, Desktop, Downloads, SSH keys, Outlook profiles, Steam session config.

• Zero-Click RCE in MCP
  writeup2026-05-06

  Payload harvests Google credentials used by the Google Docs MCP Server and other local secrets