gh-token-monitor
Named by 6 kept items in this workspace.
2 items name it under classification.key entities, 2 under threat actors and 2 under tools.
Search every workspace for gh-token-monitor. It matches the name as written, so it can find other things that share it.
The items that name it 6
Malicious background service installed by the malware; polls GitHub API every 60 seconds for up to 24 hours and wipes the home directory (rm -rf ~/ or PowerShell profile delete) if the stolen token is revoked
Persistence mechanism that watches a stolen GitHub token and executes a supplied handler when the token stops working; consistent with a pattern from Snyk's prior analysis of the same persistence mechanism.
Malicious service installed by the malware to monitor and re-exfiltrate GitHub tokens
All threat actors in this workspace.