Malware

ClawCode

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

Hackers are once again targeting developers and AI enthusiasts by impersonating popular open-source tools on GitHub... Unsuspecting users who land on these pages are tricked into downloading what appears to be a legitimate tool.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script.

T1059.001PowerShellEvidence1

Once the malware confirms it is running on a real user machine, it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script.

Persistence

1 technique

T1547.004Winlogon Helper DLLEvidence1

The malware can survive through scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

Privilege Escalation

1 technique

T1547.004Winlogon Helper DLLEvidence1

The malware can survive through scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

Stealth

2 techniques

T1036MasqueradingEvidence1

Cybercriminals create convincing fake repositories on GitHub that closely mimic the look and layout of a genuine project. Unsuspecting users who land on these pages are tricked into downloading what appears to be a legitimate tool.

T1497Virtualization/Sandbox EvasionEvidence1

Before executing any malicious behavior, it runs an extensive environment check to determine whether it is running inside a sandbox. If it detects signs of a virtual machine, known analysis tools, or suspicious system characteristics, it displays the message “Sorry, your system does not meet the minimum requirements” and quietly exits.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

It adds six folder exclusions, disables cloud-based reporting, turns off behavior monitoring, and opens three inbound firewall ports: 57001, 57002, and 56001.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Collection

1 technique

T1560Archive Collected DataEvidence1

the malware was hidden inside a 7z compressed archive file sitting on the Releases page of the fraudulent repository, making it look like a standard software download.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The C2 domains used are mikolirentryifosttry.info and zkevopenanu.cfd.

T1105Ingress Tool TransferEvidence1

the malware reaches out to Pastebin and snippet.host links to fetch Azure-hosted second-stage payloads.

Other

1 technique

T1562Impair DefensesEvidence1

it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script. It adds six folder exclusions, disables cloud-based reporting, turns off behavior monitoring, and opens three inbound firewall ports

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

May 11, 2026

Hackers Use Fake DeepSeek TUI GitHub Repositories to Deliver Malware

Rust-written multi-stage malware family delivered via fake GitHub repositories impersonating AI/developer tools. It performs anti-sandbox checks, disables Windows Defender protections, fetches second-stage payloads from Pastebin/snippet.host/Azure infrastructure, establishes persistence via scheduled tasks, Run keys, Winlogon hooks, and startup shortcuts, and uses in-memory .NET loading and thread injection to evade detection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

ClawCode

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script.

T1059.001PowerShellEvidence1

Once the malware confirms it is running on a real user machine, it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script.

Persistence

1 technique

T1547.004Winlogon Helper DLLEvidence1

The malware can survive through scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

Privilege Escalation

1 technique

T1547.004Winlogon Helper DLLEvidence1

The malware can survive through scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

Stealth

2 techniques

T1036MasqueradingEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

It adds six folder exclusions, disables cloud-based reporting, turns off behavior monitoring, and opens three inbound firewall ports: 57001, 57002, and 56001.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Collection

1 technique

T1560Archive Collected DataEvidence1

the malware was hidden inside a 7z compressed archive file sitting on the Releases page of the fraudulent repository, making it look like a standard software download.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The C2 domains used are mikolirentryifosttry.info and zkevopenanu.cfd.

T1105Ingress Tool TransferEvidence1

the malware reaches out to Pastebin and snippet.host links to fetch Azure-hosted second-stage payloads.

Other

1 technique

T1562Impair DefensesEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

May 11, 2026

Hackers Use Fake DeepSeek TUI GitHub Repositories to Deliver Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.