🎯 Host reconnaissance

The items that name it 3

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeup2026-10-31

  Collects hostname, username, OS, architecture, home and working directories, global Git email, and up to forty environment-variable names containing KEY, TOKEN, SECRET, PASS, AWS or GCP; names only, not values.

• The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
  writeup2026-09-01

  Runs cmd.exe /c chcp 65001 >nul 2>&1 & systeminfo, queries registry and username, and uses a WMI/COM-based native module (importing ole32, OLEAUT32, PROPSYS) for host recon

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeup2026-06-20

  collects hostname, architecture, platform, user ID, installed applications, and running processes