(1) DNS or proxy hits for dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc, or any HTTPS POST to a path ending /gate from a user workstation; older samples used plain HTTP to an IP on port 8080. (2) File-read telemetry where a process other than the AI tool, its IDE or backup reads the user's .claude.json, Codex config.toml or .env files, or Cursor's local state database, especially in a burst alongside browser cookie and wallet paths. (3) Symantec's SHA-256 list (17 hashes) in EDR. On a hit, isolate the host, then revoke AI-tool sessions and OAuth grants and rotate repo PATs, SSH keys, cloud keys and anything in .env files from a clean device.