[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (Doctor Web, Nov 5; BleepingComputer summary Nov 6); >2,000 Windows hosts reported compromised

Hunt: fake GitHub 'security tools' (Fscan helpers, scanners, log parsers) drop AsyncRAT, a clipper and a stealer via Electron Microsoft.exe

  • Look for: unexpected PreBuildEvent PowerShell in cloned 'security' repos; C:\Users\Public\Pictures\t.ps1 / L.ps1; unpack under C:\ProgramData\Windows.Microsoft.Photos; process names Microsoft.exe / injections into RegAsm.exe, dwwin.exe, dwm.exe.
  • Infra IOCs (Doctor Web): muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com, 130.12.182[.]172.
  • Loader Mode3 tells: PPID spoof to explorer.exe, Smart App Control registry flip, ntdll unhook, direct syscalls, EtwEventWrite/AmsiScanBuffer patches; Mode2 falls back to Defender exclusions + RegAsm inject.
  • Defense: treat unaudited GitHub security helpers as hostile until reviewed; prefer signed vendor tools; scan downloads before opening in Visual Studio.

Sources: Doctor Web: Threat actors target information security developers on GitHub (Nov 5) · BleepingComputer: Fake security tools on GitHub push backdoors and infostealers (Nov 6)