Predicta Lab

What would catch a malicious update to a tool your team already trusts? Follow @PredictaLabOff for more cyber and OSINT news.

AI coding assistants ship with marketplace auto-updates and deep access to developer machines. That makes them prime supply chain targets: one tampered build, thousands of potential footholds in the companies those developers work for.

Cursor says the SSH step failed on most hosts without admin rights. It pulled the extension, shut down its entire marketplace to audit every listing and rotated access keys. Microsoft published the analysis and IOCs. Check authorized_keys for svc-telemetry.

It is built to stay: a macOS LaunchAgent, a Linux reboot crontab and a Windows SYSTEM scheduled task, all under names mimicking monitoring software, with tunnel retries every 60 seconds. Removing the extension leaves all of that in place.

The payload plants an attacker SSH key labeled svc-telemetry, tries to enable SSH and opens a reverse tunnel to the attacker's server. It also profiles the host: hostname, user, OS, git email, plus the names of credential-looking environment variables.

On October 29, from 2:27am to 1:35pm Pacific, Cursor served tampered versions 2.1.312 and 2.1.313 of the extension. Anthropic did not develop them and says its own systems were not compromised. How the build got published under Anthropic's name is still unexplained.

A backdoored copy of Anthropic's Claude Code extension sat on Cursor's marketplace for 11 hours. Up to 5,000 developers may have installed it, and uninstalling does not clean the machine. ⬇️

Where do you draw the line between recoverable crypto and censorable crypto? Follow @PredictaLabOff for more cyber and OSINT news.

The uncomfortable lesson: the world's largest exchange was saved not by its own defenses but by centralized issuers freezing their own tokens. Both custody camps just got new ammunition.

ZachXBT and Blockaid say North Korea is the likely operator. No official attribution yet. Binance paused withdrawals, promised to cover all losses, and the drained wallets sit among the reserves meant to back customer balances.

The counterattack is a freeze race. Binance confirms 2.54 billion dollars immobilized. Tether froze 1.567 billion USDT, Circle 823 million USDC, Ripple about 200 million. One analyst puts the net loss near 1 billion dollars.

The attacker used EIP-7702 delegation, an Ethereum feature from the 2025 Pectra upgrade. A sweeper contract deployed hours earlier emptied the wallet 3.5 minutes after one valid authorization. Blockaid counted 50 attempts; exactly one matched.

20:24 UTC, October 29: wallet Binance 14 sends 167,464 ETH and 63 other tokens, including about 1.6 billion USDT, to an address created minutes earlier. Two minutes later, Binance 16 follows with 28,005 ETH.

Binance lost control of its hot wallets for 40 minutes last night. Analyst estimates of the outflows run from 3.5 to 5.9 billion dollars, and the exchange insists user funds are safe. What we know so far ⬇️

Your SSO directory leaks tomorrow. How much of your internal structure could a stranger reconstruct from it? Follow @PredictaLabOff for more cyber and OSINT news.

The lesson is older than the politics: identity systems are crown jewels. Breach one SSO dataset and you do not steal accounts, you map an institution.

The hacker says it all came from the department's Okta single sign-on. Okta says it has no evidence its own systems were compromised. DHS says it is aware of a potential breach. Timestamps point to mid-August: the data sat undisclosed for two months.

The fields go beyond names and job titles: work emails, cell phones, office locations, account details, app permissions, even Active Directory group memberships. Enough to map how an agency logs in.

Inside: about 21,000 CBP records, roughly 10,000 from ICE and HSI, nearly 1,000 from CISA, plus thousands more from USCIS, the Federal Protective Service and DHS headquarters.

On October 28, DDoSecrets published Icepick: a searchable database of more than 40,000 DHS employees and contractors. A hacker calling itself Department of Peace claimed the breach and passed the data to journalist maia arson crimew.