Unverified50% confidenceFactExact time
The malicious code scans up to more than 40 labels in the user's environment variables, filtering for entries whose names resemble keys, tokens, passwords or cloud accounts.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/31/2026
First Seen
Valid until: 11/14/2026
Sources
Related Claims
UnverifiedThe malicious code collects hostname, username, OS type, Gate email, public IP and other information and sends it out.70% similarUnverifiedIndicators of Compromise (IOCs) refer to technical artifacts found in a system or network that can be used to determine whether an intrusion has occurred, with common forms including malicious IP addresses, domain names, file hashes, and abnormal registry key values67% similarUnverified现有文档安全扫描工具主要检查宏代码、嵌入对象和外部链接等已知威胁向量，几乎没有工具会审查空格字符的渐变色标点参数是否携带编码数据65% similarUnverifiedFour of the five vulnerabilities carry forensic investigation flags, requiring a search for signs of compromise on affected hosts before closing the ticket, including anomalous files, newly created accounts, web shells, and outbound connections.62% similarUnverifiedThe threat intelligence module matches responses against known phishing kit fingerprints, screens URLs against 700,000+ threat indicators, and checks whether wallet addresses are associated with scams.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118945API
curl https://kongchang.com/api/v1/knowledge/claims/1118945MCP
get_claim(id=1118945)