🕵️ Unnamed attacker

The items that name it 10

• Bitcoin and ether holders urged to enter ‘bunker mode’ against possible AI attacks
  article2026-10-08It is written here as Unnamed attacker (Coldcard drain).

  Attacker who on July 30 began draining Coldcard hardware wallets through a five-year-old firmware bug, taking at least 1,367 BTC; maker Coinkite suspected AI helped find the flaw.

• Black Thursday revisited: MakerDAO keeper exploited for $500K
  article2026-10-07

  Exploited a missing access control vulnerability in a legacy MakerDAO auction-keeper contract to steal 200 ETH (over $500,000), then laundered the funds in 10-ETH lots through Tornado Cash.

• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeup2026-07-25It is written here as Unnamed attacker (mrmustard PyPI supply chain attacker).

  Took over maintainer account ziofil on GitHub, used the project's CI to steal the PyPI publishing token via a secret exfiltration workflow, and published a malicious mrmustard 0.7.4 package to PyPI containing a credential-stealing payload with C2 at metrics.femboy.energy.

• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22It is written here as Unnamed attacker (SentinelOne investigation).

  Created local admin account 'ssl-admin', executed show full-configuration to extract FortiGate config, decrypted embedded LDAP credentials for fortidcagent service account, authenticated to Active Directory within 10 minutes of initial access

• Everybody's shipping code they can't read
  article2026-06-25It is written here as Unnamed attacker(s).

  Republished 141 packages in the @mastra AI-agent ecosystem in a 45-minute overnight burst, slipping a malicious look-alike date-library dependency into every one; payload hunted through 160+ browser crypto wallets and established persistence across Mac, Windows, and Linux

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeup2026-06-17It is written here as Unnamed attacker (Mastra npm scope takeover).

  Republished 141 @mastra packages in a burst between 01:15 and 02:00 UTC on June 17th, injecting malicious dependency easy-day-js into each

• Nx Console VS Code Extension Compromised
  writeup2026-06-02It is written here as Unnamed attacker (Nx Console / nrwl.angular-console compromise).

  Nx Console / nrwl.angular-console compromise

• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeup2026-05-23It is written here as Unnamed attacker (Laravel-Lang supply chain attacker).

  Published malicious version tags across three Laravel-Lang repositories by exploiting GitHub's tag-to-fork-commit behavior, injecting a credential-stealing dropper (src/helpers.php) that fetches a second-stage PHP credential stealer from flipboxstudio[.]info

• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeup2026-04-09It is written here as Unnamed attacker (single operator).

  Sysdig TRT observed one source IP conducting exploitation of CVE-2026-39987 within 9 hours 41 minutes of advisory publication; built a working exploit directly from the advisory text with no public PoC; conducted a scripted PoC validation session, manual reconnaissance, and a credential theft operat

• Azure Batch Misused for Crypto Mining
  writeup2024-03-15It is written here as Unnamed attacker (compromised Azure administrator account).

  Attacker who gained access to an administrator Azure environment user account, created a resource group and Batch accounts, requested Microsoft support quota increases, and built an autonomous crypto-mining system using Azure Batch; motivated purely by financial gain, no data exfiltration, persisten