🚨 Threat Intelligence | PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager SlowMist Security Team identified a PolinRider sample in a development branch of the #LaravelNova# extension package visanduma/nova-two-factor, which has 700,000+ cumulative downloads. The malicious code is hidden in tailwind.config.js and executes during frontend builds. Instead of hardcoding C2 addresses, the loader queries #Ethereum# transactions to dynamically resolve delivery server IPs, allowing the operator to switch servers without republishing the package. The final payload is a cross-platform credential stealer targeting: 🔹 Browser accounts, cookies, and credentials 🔹 Crypto wallet data and extension storage 🔹 Password managers 🔹 Git, GitHub CLI, and other developer credentials ⚠️ Developers and CI/build environments using affected versions should inspect composer.lock and tailwind.config.js, review build-time network activity, and treat successfully executed builds as compromised. Rotate exposed credentials and wallet keys from a clean environment. Full analysis👇

⚡ Threat intelligence loses its value when it doesn't reach analysts at the point of decision. We're hosting a webinar with @elastic Security on making TI a seamless part of SOC operations, not a separate research step. ❗ Stay for live Q&A. Register:

🚨 Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft SlowMist Security Team identified a campaign masquerading as a free VPS service. The landing page at event[.]polarnode[.]vip is a decoy that silently loads lk[.]js and screens for iPhone Safari on iOS 18.4–18.6.2. Matching devices receive a hidden iframe (/dist/sandbox.html) that launches a multi-stage n-day chain reusing the DarkSword six-CVE chain: WebKit RCE, GPU / mediaplaybackd sandbox escapes, and kernel read/write. Post-exploitation injects three plugins: 🔹 SpringBoard (sync.js) — recursively collects files from app containers, shared AppGroups, or absolute paths 🔹 securityd (auth.js) — collects genp / inet data from Keychain 🔹 kbd (input.js) — captures keyboard input when imToken, TokenPocket, or TronLink is in the foreground MistEye reconstructed the delivery path and extracted C2, loader, and implant IOCs. When GTIG first observed DarkSword, three of the six CVEs were zero-days in the wild. By September 2026, all six had been publicly disclosed and patched by Apple, making the current delivery an n-day reuse of the DarkSword six-CVE chain. ❗️A page visit alone does not prove seed phrase or private key theft — confirm with device forensics first. A free VPS page that only wants Safari on a narrow iOS range is not a VPS page. Update to iOS / iPadOS 18.7.3 or 26.3+, and block / / port 36887. Read the full analysis 👇

🚨 Threat Intelligence | The StealC Info-Stealing Chain Behind the Qwen Impersonation Repository SlowMist Security Team identified a #GitHub# repository impersonating local quantized weights for Qwen 3.8 27B. A real Q4_K_M 27B package should exceed 16 GB. The asset delivered was only 487 KB — no GGUF weights, just three files: Application.cmd, a renamed LuaJIT interpreter, and an obfuscated Lua script disguised as cert.txt. The official #Qwen# project was not compromised. The repo kept the look of a normal offline model project, while the malicious ZIP sat in assets/. After deobfuscation, the script collects host data, takes a screenshot, and POSTs them to C2. When the hardcoded server fails, it reads a fallback C2 from a Polygon contract via eth_call, so operators can rotate infrastructure with a single on-chain transaction. Preserved C2 responses then delivered an inner payload we attribute to #StealC#, targeting: 🔹 Browser logins, cookies, and history — including a Chrome App-Bound Encryption bypass 🔹 Email, WinSCP, and Steam credentials 🔹 Wallet-related files and extension data, dispatched by server-side tasks MistEye reconstructed the multi-stage chain and compared 29 similar ZIPs across 23 repositories using the same Lua delivery stack. Between two collection dates, repositories, filenames, the outer PE, and the AES key had already rotated. A 27B model that downloads in 487 KB is not a model. Inspect asset size and unpack downloaded packages before running them. Read the full analysis 👇

🚨 Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension Following @Will42W’s warning about TRAE IDE extension supply chain risks, SlowMist investigated the malicious extension juannegro.solidity. Although removed from Open VSX, the extension was still available through the TRAE marketplace as of July 18, 2026. It impersonated a legitimate Solidity plugin and acted as a cross-platform malware dropper. Our analysis found that it: 🔹 Impersonates a legitimate Solidity extension and uses the marketplace as the initial malware delivery channel 🔹 Automatically executes after IDE startup and establishes persistence across platforms 🔹 Uses an Ethereum smart contract to store and retrieve dynamic C2 configurations 🔹 Allows attackers to update C2 endpoints and payload delivery without republishing the extension This incident highlights how extension marketplaces can become initial infection vectors, while blockchain infrastructure can be abused for dynamic C2 management. Users who installed juannegro.solidity should remove the extension and check their systems for potential compromise. Full analysis👇

🚨 Threat Intelligence | Fake Recruitment Campaign Delivers Malware via GitHub Repository MistEye recently detected a malicious campaign targeting developers through fake Web3 recruitment. Attackers impersonated recruiters on LinkedIn, built trust through discussions about work experience and interviews, then sent a GitHub repository disguised as an “interview MVP” and tricked developers into running the project. Our analysis found that the malicious repository hid theme/js/auron-core.min.js as a Tailwind plugin. When developers ran the project’s development or build commands, the hidden Node.js loader was triggered and deployed multiple payloads for: 🔹 Browser credential & wallet data theft 🔹 Sensitive file collection and exfiltration 🔹 Remote command execution and interactive Shell access 🔹 Clipboard monitoring This campaign shows how trusted development workflows can become attack vectors. Developers should always inspect project scripts, dependencies, and build configurations before running unknown repositories. Full analysis👇

🚨 Threat Intelligence | Analysis of a Fake TronLink Chrome Extension Phishing Campaign 🚨 SlowMist’s MistEye threat monitoring system recently detected a high-risk phishing campaign targeting #TRON# wallet users. Attackers created a fake Chrome MV3 extension impersonating @TronLinkWallet, using Unicode bidirectional control characters and Cyrillic homoglyphs to spoof the brand name. Once installed, it loads a full phishing page via remote iframe — forming a “shell-core separation” credential theft chain. 🔍 Key Findings: 🔹 The extension name uses homoglyphs for disguise. Its Chrome Web Store page inherits the real extension’s high user count and positive reviews, significantly lowering review barriers. 🔹 Local code is extremely minimal — it only loads a remote page, making static analysis almost useless for detecting malice. 🔹 The remote phishing page perfectly replicates the official TronLink Web wallet UI, stealing mnemonic phrases, private keys, Keystore files, and passwords, then exfiltrating them in real time via Telegram Bot. 🔹 Built-in anti-analysis features (disables right-click, DevTools, drag-and-drop, printing) and geo/language-based redirection for Russian users to evade detection. ⚠️ This is not a simple fake extension — it employs advanced techniques like remote dynamic loading and anti-forensics, making it extremely difficult for traditional static scanners to catch. 🛡️ Immediate Actions : • Uninstall any suspicious extension (Malicious ID: ekjidonhjmneoompmjbjofpjmhklpjdd) • Official TronLink extension ID: ibnejdfjmmkpcnlpebklmnkoeoihofec • Clear localStorage and check for abnormal traffic • If credentials were entered, create a new wallet immediately and transfer assets 📖 Full technical analysis + IOCs + self-check guide here 👇

The latest Threat Intelligence report is an absolutely terrifying and important read. As models become more intelligent, without the right safeguards and monitoring they also become more dangerous. Many capabilities are dual use: a model that codes well can be used to hack critical infrastructure; a model that assists with biology research can also be used to engineer the next pandemic. These issues are complex, thorny, and increasingly important for everyone to understand so that the world can weigh in and respond to rapidly escalating risks.