language
Windows scripting environment used for command-based staging, loader execution and in-memory download-and-run steps throughout the chain.
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
RuntimeWire says it drove an agent thread in Cursor Desktop from a terminal using a gated feature that appears in neither the CLI guide nor the changelog.
Reality
A dev.to writeup shows ANTHROPIC_BASE_URL set in a terminal does not reach the VS Code extension's agent process, which inherits the editor's environment instead.
Reality
Sophos says a June 2026 campaign used winget to install the Deno runtime on victim machines, then used deno.exe to fetch, run and persist remote JavaScript ending in a Python infostealer.
Reality
Attackers installed a legitimate JavaScript and TypeScript runtime on victim hosts to run payloads in memory. The middle of the chain barely varied, which is where detection work belongs.
Reality