Unverified50% confidenceFactExact time
The malicious code collects hostname, username, OS type, Gate email, public IP and other information and sends it out.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/31/2026
First Seen
Valid until: 11/14/2026
Sources
Related Claims
UnverifiedThe malicious code scans up to more than 40 labels in the user's environment variables, filtering for entries whose names resemble keys, tokens, passwords or cloud accounts.70% similarUnverifiedIndicators of Compromise (IOCs) refer to technical artifacts found in a system or network that can be used to determine whether an intrusion has occurred, with common forms including malicious IP addresses, domain names, file hashes, and abnormal registry key values70% similarUnverifiedBlack-market practitioners obtain real names, addresses, phone numbers and other information through data breach databases, and impersonate others' identities to complete Nextdoor's address verification process.68% similarUnverifiedSources of stolen passwords include data breaches, phishing attacks, malware theft, and credential databases sold on dark web markets.68% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118944API
curl https://kongchang.com/api/v1/knowledge/claims/1118944MCP
get_claim(id=1118944)