Skip to content

sckit

Named by 3 kept items in this workspace.

Search every workspace for sckit. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • article2026-10-18It is written here as sckit (Go binary bundled in malicious MemTensor MemOS releases; harvests credentials and secret environment variables and reports to servers under skyleen.fr).

    Go binary bundled in malicious MemTensor MemOS releases; harvests credentials and secret environment variables and reports to servers under skyleen.fr

  • writeup2026-09-23

    Credential-harvesting and self-propagating malware campaign distributed via compromised npm and PyPI packages; campaign IDs 'cloud-openclaw-semi-nuclear' (npm) and 'memos-semi-nuclear' (PyPI).

  • writeup2026-09-23

    Stripped, statically linked Go malware binary bundled cross-platform (Linux, macOS, Windows; x64 and arm64) with the compromised packages; searches $HOME for developer secrets and exfiltrates them to C2 servers under skyleen[.]fr; uses configuration schema sckit.runtime.v1; contains strings suggesti

All threat actors in this workspace.