GemStone

Named by 2 kept items in this workspace.

Search every workspace for GemStone. It matches the name as written, so it can find other things that share it.

The items that name it 2

[tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
article2026-09-24It is written here as GemStone: browser extension disguised as Google Gemini that steals cookies, captures keystrokes and polls for commands through a Cloudflare Worker.
browser extension disguised as Google Gemini that steals cookies, captures keystrokes and polls for commands through a Cloudflare Worker
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
writeup2026-09-09
Malicious browser extension tracked by Proofpoint, masquerading as an 'AI-powered browsing companion by Google Gemini'. Delivered by TA412 via msgbox.exe installer; functions as a browser-surveillance and credential-theft backdoor with keylogging, screenshotting, and data exfiltration capabilities,

All threat actors in this workspace.