Attributed metadata history
Up to 100 retained publisher events per page for f24347cfcf8330703a0b90f82aaf76f6e4296378c513ed131579bd4f8b9bb455. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🐍 Malicious Python Package Installation Introduced a new analytic story with four detections focused on abuse of the Python package installation lifecycle. New coverage identifies unexpected network connections during package builds, creation of executable .pth configuration files and Python site hooks, and manipulation of the PYTHONPATH environment variable. These analytics help defenders uncover supply-chain compromises that execute code during installation or establish persistence across subsequent Python sessions, improving visibility into threats targeting developer workstations and build environments. 🕵️ Vidar Stealer Detection Coverage Introduced a new analytic story for the Vidar information stealer, combining a new detection for uncommon processes reading sensitive cloud profile files with existing analytics covering unauthorized browser credential-store access and suspicious process behavior. This coverage helps identify attempts to collect saved credentials, cookies, Azure CLI profile metadata, and other information that could support account takeover, cloud reconnaissance, or data exfiltration, giving defenders an earlier opportunity to conta
Fingerprint: a7465478169e61f7f8f9df75824aa720297ba95068de2c5375ad1bf108afee7e
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c