Person

Karlo Zanki

Socket researcher credited as author of the report on the 19 malicious Chrome and Edge extensions.

Known aliases

Zanki

Current stories

securityConfirmed2 publishers

Two actions-cool GitHub Actions resumed running the Mini Shai-Hulud stealer after coming back online

Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.

Publishers:bleepingcomputer.comscworld.comthehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 43%
Operator: Operator 47%
Investor: Investor 10%

Reality

Evidence60
Adoption40
Hype gap+15
Incentives30
Confidence65

securityOne report1 publisher

Superior crew slips wallet-drainers into browser extensions on the version bump

Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.

Publishers:thehackernews.com

Reality

Evidence60
Adoption35
Hype gap+10
Incentives: Insufficient
Confidence60

buildOne report1 publisher

A Firefox extension arms itself five seconds after install from a lookalike Google domain

The add-on shipped to Mozilla's store as a dispatcher and took its instructions afterwards from a page it opened itself, on a domain built to resemble googleusercontent.com.

Publishers:socket.dev

Reality

Evidence62
Adoption10
Hype gap−10
Incentives55
Confidence58

securityOne report1 publisher

A DPRK-linked package campaign has started publishing to HashiCorp's Terraform Registry

Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.

Publishers:thehackernews.com

Reality

Evidence66
Adoption21
Hype gap+14
Incentives72
Confidence58

buildOne report1 publisher

Chrome's auto-update default distributed the drainer once the extension changed hands

Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.

Publishers:socket.dev

Reality

Evidence62
Adoption54
Hype gap+14
Incentives71
Confidence58