Loading story…
CloudSEK reported that an exposed VHX Harvester v0.1.0 FastAPI panel at 69.48.229.140 was being used to prepare a cryptojacking operation against hosts on the vast.ai GPU-rental marketplace. The panel allegedly enumerated GPU hosts, scanned exposed services, harvested metadata and environment variables, deployed bridge agents into co-resident containers to probe Docker bridge networks, and obtained one root shell on a Jupyter Notebook instance. Its source code also described planned credential harvesting, stored-XSS attacks against Caddy authentication portals, Jupyter compromise, and cryptocurrency mining; no miner deployment had been observed. As of September 25, CloudSEK reported 297 discovered hosts, 13,368 scanned endpoints, 416 findings, and 25 bridge agents.
The infrastructure was linked to 85 malicious @prime0 npm packages published within minutes and impersonating 29 popular libraries through generated misspellings. Package installation reportedly beaconed host information to 69.48.229.140:8080, while at least one package could poll the server every 30 seconds for shell commands. CloudSEK assessed that scoped package names were intended to influence npm search and autocomplete rather than capture ordinary unscoped installation typos, and cautioned that shared C2 infrastructure does not prove the npm packages enabled the GPU operation. The @prime0 scope was removed; organizations should investigate dependency manifests and lockfiles for @prime0 references, review potential execution on affected developer or build hosts, and validate reported indicators before blocking or SIEM ingestion.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
By this date, the alleged VHX Harvester operation had enumerated 297 vast.ai GPU hosts, scanned 13,368 service endpoints, and collected metadata from 416 services. It had deployed 25 co-resident bridge agents and reportedly obtained one root shell on an exposed Jupyter Notebook instance, but had not deployed a cryptocurrency miner.
The npm account prime0 published 85 packages under the @prime0 scope in approximately three minutes, impersonating 29 popular libraries. The packages contained remote-command code that fingerprinted hosts during installation and could poll 69.48.229.140:8080 for shell commands when imported.
CloudSEK published its second TOPHIT analysis describing an exposed VHX Harvester v0.1.0 panel at 69.48.229.140. The report said 17 API endpoints lacked authentication and that an exposed agent archive leaked C2 source code and hardcoded panel credentials.
The @prime0 scope was subsequently removed from the npm registry after the malicious-package activity was identified. The reporting did not establish that any developer installed the packages or was successfully compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cloudsek.com
Open sourcecloudsek.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Mini Shai-Hulud** campaign compromised widely used developer packages across **npm, PyPI, and Packagist/Composer**, including SAP CAP components, `intercom-client`, `intercom/intercom-php`, and PyTorch Lightning’s `lightning` package. The malicious releases delivered an obfuscated credential stealer executed with the **Bun** runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to **TeamPCP**. Reports estimated exposure ranging from more than **1,000** to roughly **1,800 repositories**, with no `CVE`, `GHSA`, or `OSV` identifiers assigned at disclosure. Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s `cloudmtabot` account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm **OIDC trusted publishing** policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting `.vscode/tasks.json` entries with `"runOn": "folderOpen"` and `.claude/settings.json` `SessionStart` hooks, a technique compared to the earlier **PolinRider/TasksJacker** tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized `folderOpen` tasks and Claude hooks.
Jun 29, 2026
Researchers reported an active campaign exploiting more than 1,000 internet-exposed **ComfyUI** instances, especially deployments running without authentication and those using unsafe custom nodes or **ComfyUI-Manager**, to gain unauthenticated remote code execution. The attackers used a purpose-built Python scanning pipeline to sweep cloud IP ranges, identify vulnerable systems, and deploy a payload known as **`ghost.sh`**, then monetized access by installing **XMRig** for Monero mining and **lolMiner** for Conflux mining while also enrolling compromised hosts into a **Hysteria v2** proxy botnet controlled through a Flask-based command-and-control panel. The operation showed extensive persistence and defense-evasion tradecraft, including fileless execution via **`memfd_create`**, process masquerading, an **`LD_PRELOAD`** rootkit for process hiding, watchdog-based restoration, scattered backups, and immutable file locking. Investigators also found reinfection mechanisms in newer scanner versions, including a fake **"GPU Performance Monitor"** custom node that re-downloads the payload every six hours and a poisoned default startup workflow that relaunches it whenever ComfyUI restarts. Infrastructure tied to **`77.110.96[.]200`** and additional SSH-linked hosts across China Mobile, DigitalOcean, and AWS suggests a broader opportunistic campaign that may overlap with activity targeting other exposed services such as Redis.
Jun 29, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026