Fake recruiters, malicious dev tools, tracked in the open.

Live events

Automated and unverified, from our passive collectors. Updated several times a day. All live events and filters

Latest campaigns

Reviewed by a person, with a confidence level and sources.

• Binance theft: fake job interview, swapped developer tool, wallet infrastructure

  Moderate confidence · Fake interview / recruiter lure · unknown · first seen 2026-10-20, last seen 2026-10-29

  Binance says the theft on 29 Oct started with a fake job interview that ended in a booby-trapped take-home coding assignment run on a work Mac. The attacker later moved through an internal AI tool and a container-deployment token to the wallet signing service.

• Trojanized Claude Code extension pushed through Cursor's marketplace

  Moderate confidence · IDE extension · taken-down · first seen 2026-10-29, last seen 2026-10-29

  For about 11 hours on 29 Oct, Cursor users received a repackaged anthropic.claude-code extension (2.1.312 and 2.1.313) through Cursor's own marketplace. It planted an SSH backdoor. The cause was access to the marketplace, not the extension publisher.

• GhostAction: stolen GitHub tokens push credential-stealing "security audit" workflows

  Moderate confidence · Publisher / pipeline compromise · unknown · first seen 2026-10-13, last seen 2026-10-21

  Stolen GitHub credentials were used to push workflows with names such as security-audit.yml into about 23,000 public repos. The workflows dump repository secrets to the attacker. Later variants added a VS Code folderOpen task and a fake font file that steals cloud and AI-provider credentials.

All campaigns