published 2026-11-06
If you clone and run these repos, you get AsyncRAT, which gives an attacker control of your machine, plus a clipper that swaps cryptocurrency addresses and an infostealer that steals credentials. The malicious code is hidden behind long stretches of whitespace so it looks harmless when you skim the file.
Source: @DFIR_Radar on X
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1896 and your operating system.