🕵️ Unidentified attacker

The items that name it 6

• Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen
  article2026-10-09It is written here as Unidentified attacker(s) (possible supply-chain tamperer).

  Unknown actor(s) suspected of tampering with Ledger hardware wallets sold through reseller CryptoBilis, potentially pre-generating recovery phrases to later access funds; not independently confirmed.

• MetaMask unstakes $1.4B of ETH after validator rewards stolen
  article2026-10-01It is written here as Unidentified attacker(s) (block reward diversion).

  Diverted block rewards from 18 MetaMask validators to a Tornado Cash-funded address instead of the correct fee recipient; the address held 0.46 ETH, received 0.1 ETH funding from Tornado Cash, and 18 incoming ETH transfers via Titan Relay: Forwarder worth less than $1,000 total, with no outgoing tra

• MetaMask Exits Lido Validators Amid Infrastructure ‘Security Incident’
  article2026-10-01It is written here as Unidentified attacker(s).

  Compromised part of MetaMask Staking's (ex Consensys Staking) infrastructure in an 'ongoing security incident' / 'infrastructure compromise' under investigation; identity, method, and full scope not disclosed by MetaMask or Lido as of the report.

• 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers
  writeup2026-07-01It is written here as Unidentified attacker (JetBrains Marketplace malicious plugin campaign).

  Operated 15 malicious JetBrains plugins across 7 vendor accounts from late October 2025 through June 2026, stealing AI provider API keys from roughly 70,000 installations; ran a C2 server at 39.107.60.51 (Alibaba Cloud, Beijing) with a Chinese-language admin panel titled "信息管理平台" (Information Manage

• simonecorsi/mawesome GitHub Action has been compromised
  advisory2026-07-01

  Compromised the simonecorsi/mawesome GitHub repository on June 24, 2026 by force-pushing malicious commits and repointing several version tags to the malicious commit, causing workflows running against those tags to execute attacker code inside the GitHub Actions runner.

• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
  advisoryIt is written here as Unidentified attacker (supply chain compromise actor).

  Gained ability to move tags in actions-cool/issues-helper and actions-cool/maintain-one-comment repositories, re-pointing every tag to imposter commits containing malicious credential-exfiltration code. Generated a unique imposter commit per tag with fake 'Build action for vX.Y.Z' commit messages mi