Socket AI Scanner

Reported Context (11)

Socket’s AI Scanner flagging the Phantom impersonator as known malware. Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Recovery Phrases and Private Keys
Socket AI Scanner classifies [email protected] as known malware based on high-confidence cluster attribution rather than an active payload in this version, highlighting shared development Socket traces a VS Code theme cluster across marketplaces to GlassWorm-linked malware
Socket’s AI Scanner independently detected the malicious proc-macro1 crate on August 20, 2026 at 07:29:50 UTC. At that point only [email protected] had been republished with the malicious dependency; malicious Malicious Rust Crates Deliver Cross-Platform Backdoor During Builds
Socket AI Scanner flags the malicious 3ABBY- Browser Extension and surfaces its broad browser and wildcard host permissions. Socket Links 77 Firefox Extensions to Crypto Wallet and Credential Theft
Socket AI Scanner’s analysis of the malicious dinushchathurya/srilankan-local-authorities@dev-main Packagist version identifies a GitHub Actions workflow that downloads and executes an unverified payload, performs Compromised GitHub Actions Repositories Fuel cPanel/WHM Exploitation and Credential Theft

CVE (1)

Malware (9)

People (2)

Threat Actors (1)

MITRE ATT&CK (52)

Vendors (20)

Products (97)

Tools (3)

Industries (10)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.