Unverified50% confidenceFactExact time
The capture hook the developer wrote is a Windows-only cmd.exe one-liner, and after the early setup session was triggered it went silent, so the commit links for the 13 checkpoints are correct but the transcripts retain only the setup prompt.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/18/2026
First Seen
Valid until: 1/16/2027
Sources
Related Entities
Related Claims
Unverified攻击链利用初始化脚本查询DNS的TXT记录，将恶意shell命令藏在TXT字段中，脚本执行DNS查询时返回的文本被直接传入执行函数完成注入61% similarUnverifiedThe commands executed via ClickFix are often obfuscated PowerShell or mshta instructions that pull the next-stage malicious payload from a remote CDN; because the download and execution occur within a system process rather than a browser sandbox, they can bypass protective layers such as SmartScreen.59% similarUnverifiedThe deployment method is to place the checkpoint in the ComfyUI/models/text_encoders/ directory and point the loader node to it, allowing a single text encoder to handle both prompt enhancement and visual decoding simultaneously.58% similarUnverifiedSystem-level hotkey text injection is technically implemented via a global keyboard hook combined with simulated input; Windows allows applications to listen to global key events through the SetWindowsHookEx API.57% similarUnverifiedOperators can narrow the attack surface by editing the host client's execution parameters (typically located in the claude_desktop_config.json file) to pass in an exclude tools flag at initialization, revoking access to PowerShell and registry modifications.57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1058335API
curl https://kongchang.com/api/v1/knowledge/claims/1058335MCP
get_claim(id=1058335)