Loading story…
An open-source, cross-platform tool called Tirith was released to help prevent command-line “imposter” attacks that abuse Unicode homoglyphs and other terminal-rendering tricks to make malicious URLs and commands appear legitimate. Tirith hooks into common shells (including bash, zsh, fish, and PowerShell) and inspects pasted commands before execution, aiming to stop execution when it detects deceptive URLs or suspicious patterns; the tool is available via GitHub and as an npm package.
Reporting notes that while web browsers have added mitigations for lookalike-domain and mixed-script issues, terminals remain susceptible because they can render Unicode, ANSI escape sequences, and invisible characters in ways that mislead users. Tirith’s stated detection coverage includes homograph/homoglyph domains (including punycode and mixed scripts), terminal injection (e.g., ANSI escapes, bidi overrides, zero-width characters), pipe-to-shell patterns (e.g., curl | bash), dotfile hijacking (e.g., ~/.bashrc, ~/.ssh/authorized_keys), insecure transport (e.g., HTTP-to-shell/TLS disabled), supply-chain risks (e.g., typosquatted repos/untrusted registries), and credential exposure via URL tricks (e.g., userinfo URLs and shorteners).
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
An open-source, cross-platform tool named Tirith was released to detect and block homoglyph URL attacks and other deceptive command-line patterns by inspecting pasted commands before execution. It integrates with zsh, bash, fish, and PowerShell, and also flags risks such as terminal injection, pipe-to-shell patterns, dotfile hijacking, insecure transport, supply-chain issues, and credential exposure.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **HalluSquatting**, a prompt-injection technique that abuses AI coding assistants' tendency to hallucinate package, repository, plugin, or registry names and then retrieve them automatically. By predicting the fake identifiers a model is likely to invent, attackers can register those names on services such as GitHub or plugin stores, seed them with malicious instructions or payloads, and induce the assistant to execute attacker-controlled code. The researchers reported highly repeatable hallucinations—reaching up to **85%** for repository requests and **100%** for some skill-install scenarios—and said the method can deliver reverse shells and other malware without relying on software exploits, worms, or stolen credentials. The attack was reported to affect tools including **Cursor**, **Cursor CLI**, **Gemini CLI**, **Windsurf**, **GitHub Copilot**, **Cline**, **OpenClaw**, **ZeroClaw**, and **NanoClaw**, many of which can fetch third-party resources and run with elevated command-line privileges. Researchers from **Tel Aviv University**, **Technion**, and **Intuit** said they disclosed the issue to vendors while withholding full reproduction details, warning that the technique could enable large-scale device compromise, botnet assembly, and DDoS activity across mixed environments. Recommended defenses include forcing assistants to search and verify resources before fetching them, validating package and repository names, disabling unattended auto-run behavior, and having platforms reserve likely hallucinated identifiers.
Jul 15, 2026
Attackers are increasingly compromising macOS systems through **ClickFix** and related social-engineering lures that trick users into pasting malicious commands into Terminal, often behind fake Cloudflare checks, bogus troubleshooting steps, fraudulent support messages, or compromised websites. A large campaign tied to hundreds of hacked WordPress sites served platform-specific payloads and used the **Polygon** blockchain to hide command-and-control locations, while the macOS payload ran largely in memory, harvested Keychain data, browser information, SSH keys, screenshots, and other files, then staged stolen data in `/tmp/osalogging.zip` before exfiltrating it. Researchers said the technique does not rely on a macOS software flaw, but on convincing victims to execute attacker-supplied commands themselves. Threat reporting indicates the tactic has become a dominant initial-access method against Mac users, especially cryptocurrency holders and developers, and that recent Apple paste warnings in Terminal have already been bypassed through Script Editor abuse. Separate intrusion research linked cryptocurrency-focused activity to malware families including **DEEPBREATH**, **SUGARLOADER**, and **CHROMEPUSH**, showing how post-compromise tooling on macOS can escalate from social engineering to broad credential and data theft by targeting `TCC.db`, Keychain contents, Chromium-based browsers, Telegram data, and Apple Notes. Security teams are being urged to prioritize behavioral detection, cross-platform response, and user controls that prevent unverified command execution on Macs.
Jul 16, 2026
Multiple malicious npm packages have been discovered targeting developers by employing advanced obfuscation techniques and typosquatting to mimic popular legitimate packages such as *TypeScript*, *discord.js*, *ethers.js*, *nodemon*, and *Claude Code*. Security researchers revealed that these packages use up to four layers of obfuscation—including eval wrapping, XOR encryption, URL encoding, and control flow manipulation—to evade static analysis and conceal credential-stealing malware. The attack chain often begins with deceptive tactics, such as displaying fake CAPTCHAs, and proceeds to exfiltrate sensitive information like IP addresses and credentials to attacker-controlled servers. In one notable case, a package impersonating the official Anthropic CLI was found to proxy commands and data back to the threat actor, enabling both credential theft and remote command execution. These incidents highlight the persistent risks posed by weak validation and oversight in the npm ecosystem, allowing threat actors to publish lookalike packages that are difficult to distinguish from legitimate ones. The sophisticated payloads not only target local developer environments but can also compromise CI/CD pipelines, amplifying the potential impact. Security experts emphasize the need for improved package metadata validation and greater vigilance among developers to mitigate the risk of supply chain attacks through open-source dependencies.
Jun 29, 2026