← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,422
Relationships
32,516
Potential duplicates
0
Filter by kind
Entities (event)
↯23bea4dc
Leap begins building on the Cosmos interchain. Within approximately one year, the team reports over 300,000 users across its product suite.(2022-07-01:leap-wallet)event
↯67ecb25f
Terra blockchain collapses. Terraform Labs — an investor in Leap — fails. Leap begins pivoting to the broader Cosmos ecosystem.(2022-05-01:leap-wallet)event
↯687f522d
Leap announces $3.2 million private token sale co-led by CoinFund and Pantera Capital, with participation from Arrington Capital, Accel, and Terraform Labs. Implied valuation approximately $40 million.(2022-04-05:leap-wallet)event
↯37b32f26
Leap Wallet founded by Sanjeev Rao in Vancouver, British Columbia, with a $50,000 grant from Terraform Labs. Initial product is a Terra ecosystem browser extension.(2021-11-01:leap-wallet)event
↯07302fd3
The Hacker News publishes comprehensive coverage citing Sonatype and OpenSourceMalware research, describing 1,033 total packages, crypto drain capabilities, Aeza Group infrastructure link, and connection to Moika campaign.(2026-08-10:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯f4cbb8ed
SC Media and other outlets publish coverage. OpenSourceMalware co-founder Jenn Gile reports total confirmed WEL1DROPPER packages at 1,033.(2026-08-08:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯5e3300d2
Sonatype Research Labs publishes campaign tracking under the name 'Flooding Dropper' (sonatype-2026-005660), identifying 846 malicious npm components. Campaign velocity reportedly slowed after discovery week.(2026-08-07:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯5161d8a1
OpenSourceMalware publishes analysis of the AI slopsquatting campaign, documenting 700+ malicious npm packages published in approximately 48 hours and naming the campaign 'WEL1DROPPER'.(2026-08-06:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯071b6040
OpenSourceMalware researchers identify bigops-backend as the first documented WEL1DROPPER package, triggering a cross-platform native binary payload on Windows, Linux, and macOS.(2026-08-05:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯6bedb4be
Moika Wave 3: Fourth account emcd-vue publishes packages impersonating EMCD cryptocurrency exchange with advanced obfuscation.(2026-06-01:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯d8527b17
Moika Wave 2: Third account t-in-one adds 12 packages, including impersonation of Sberbank's payment widget. Microsoft Security Blog separately documents 33 malicious npm packages abusing dependency confusion.(2026-05-29:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯26228231
Moika Wave 1: npm accounts mr.4nd3r50n and pik-libs publish 164 malicious packages targeting cloud platform and financial services internal scopes within 25 minutes.(2026-05-27:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯4aed43cd
Moika dependency confusion campaign begins: over 250 malicious npm packages published, exfiltrating process.env contents and delivering OS-specific second-stage payloads. Assessed by OpenSourceMalware as a predecessor to WEL1DROPPER.(2026-04-01:wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026)event
↯4fcd67cc
French Finance Ministry confirms the June 2026 DGFiP breach affecting 678,437 taxpayers. Multiple outlets including The Block, Decrypt, and Bitcoin Magazine publish warnings to crypto holders about the compounded physical attack risk.(2026-08-14:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯7634bed2
Threat actor ZeroBytes publicly claims responsibility for the DGFiP breach on breach forums, stating data from more than 600,000 individuals was obtained.(2026-08-12:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯829f3c40
CryptoTimes and other outlets report Chainalysis data confirming France as the global wrench attack hotspot in H1 2026, with over USD 30 million stolen.(2026-08-06:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯9198d588
CertiK Intel3D H1 2026 Wrench Attacks Report formally published via GlobeNewswire press release.(2026-07-25:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯82963edf
CertiK publishes its H1 2026 Wrench Attacks Report, recording 52 verified global incidents (33 in France), USD 124.1 million in estimated financial exposure, and a 33% year-over-year surge.(2026-07-22:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯edc7fb5c
French Interior Minister Laurent Nuñez publicly discloses that authorities have logged more than 70 crypto-related violent incidents. DGFiP cuts off attacker's access around this period.(2026-06-30:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯b1e93452
Unauthorized intrusion into DGFiP systems occurs. Attacker allegedly gains access using stolen or misused credentials of a legitimate user, connects to the internal VPN, and uses an internal search tool to extract taxpayer records.(2026-06-26:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯b1709b8c
CoinDesk publishes investigation into the rise of wrench attacks, documenting France's emergence as global epicenter and quoting TRM Labs on the strategic shift from technical to physical targeting.(2026-04-19:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯9afe5015
Forbes publishes investigation into France's crypto kidnapping crisis, noting a pattern of 'zero convictions' as a contributing factor in the escalating attack rate.(2026-02-14:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯4af3349f
Ghalia C., the Bobigny tax office employee, is reported to have lost a bail appeal and remains in custody, facing charges of complicity in violence and criminal conspiracy. Case reported by Gizmodo.(2026-01-10:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯5733d346
Stolen Waltio database — containing data on approximately 50,000 users of the French crypto tax platform — appeared for sale on BreachForums. The breach had not yet been detected by Waltio.(2025-12-24:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯ab2a4978
Ledger co-founder David Balland kidnapped in France. One of his fingers was reportedly severed before police rescued him, in a case that drew international attention to France's crypto violence problem.(2025-01-01:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯1b88b907
Three armed men assaulted a La Santé prison guard in his Montreuil home. French investigators later allege that Ghalia C., a Bobigny tax office employee, provided the attackers with the victim's address using unauthorized access to Mira, the tax administration's internal software.(2024-09-01:france-dgfip-tax-data-breach-crypto-wrench-attack-enablement-august-2026)event
↯5139148c
Huntress published full technical analysis of the Go-based macOS infostealer, documenting the DRAIN function, Aeza Group C2 infrastructure, IOCs, and remediation steps. AppleInsider, The Hacker News, BleepingComputer, IT Security Guru, Infosecurity Magazine, SOC Prime, and AppleMagazine covered the findings the same day.(2026-08-06:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯554a2485
Microsoft Security Blog published an analysis documenting that a macOS ClickFix campaign had evolved to include new obfuscation techniques, providing broader context for the threat landscape one day before the Huntress publication.(2026-08-05:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯e7d65cfc
Huntress analyst Andrew Brandt discovered components of the Go-based macOS stealer during a retrospective threat hunt on a monitored endpoint, identifying the March 2026 infection approximately three months after the fact.(2026-06-01:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯c536ad4d
AppleInsider reported on a separate but related macOS ClickFix CAPTCHA campaign using Terminal-paste delivery already active in the wild, documenting the social engineering technique broadly.(2026-03-10:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯df9db0eb
Approximate date of initial infection: A macOS endpoint monitored by Huntress MDR was compromised via a ClickFix social engineering attack, installing the Go-based infostealer. The infection remained undetected for approximately three months.(2026-03-01:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯e3c6e3ba
Australia imposed additional sanctions on Aeza-related infrastructure in a round targeting ransomware infrastructure providers; UK had already joined the July 2025 U.S. designation of Aeza International Ltd.(2025-11-01:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯a84d5602
U.S. Treasury OFAC sanctioned Aeza Group LLC and three affiliated entities (Aeza International Ltd., Aeza Logistic LLC, Cloud Solutions LLC) along with four individual executives, for providing bulletproof hosting infrastructure to ransomware and infostealer operators including Meduza, Lumma, and BianLian.(2025-07-01:clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026)event
↯a047e023
HackRead published coverage confirming gamers, cryptocurrency users, and web application users as the primary target demographics, and detailing the malware's harvesting of Steam, Valorant, Roblox, and Minecraft accounts alongside wallet seed phrases.(2026-08-15:vanta-stealer-python-infostealer-targeting-crypto-wallets)event
↯386ecd6c
CyberSecurityNews reported that Vanta Stealer empties browser vaults, crypto wallets, and gaming accounts, describing its speed of data extraction on compromised Windows systems.(2026-08-10:vanta-stealer-python-infostealer-targeting-crypto-wallets)event
↯952862f3
GBHackers reported on Vanta Stealer's use of PyArmor obfuscation, its cross-platform Python base, and its targeting of browser passwords, crypto wallets, and Discord tokens.(2026-08-07:vanta-stealer-python-infostealer-targeting-crypto-wallets)event
↯9ab4d646
Rankiteo catalogued the threat with a severity rating of 85/100, noting the malware's targeting of Discord, Telegram, Roblox, and Minecraft alongside browser passwords and cryptocurrency wallets.(2026-08-06:vanta-stealer-python-infostealer-targeting-crypto-wallets)event
↯a590fe71
Point Wild's Lat61 Threat Intelligence Team (researchers Prathamesh Shingare and Kedar Shashikant Pandit) published the primary technical dissection of Vanta Stealer, documenting its PyInstaller/PyArmor architecture, dynamic module retrieval, targeted data categories, exfiltration mechanism, and 20 SHA256 IOCs.(2026-07-28:vanta-stealer-python-infostealer-targeting-crypto-wallets)event
↯0d1313d0
TrapDoor supply chain campaign detected targeting 34 packages across npm, PyPI, and Crates.io, stealing crypto wallet keystores, SSH keys, and cloud credentials from developers.(2026-05-19:requests-secure-v2)event
↯0191aaa7
RubyGems and PyPI reported hit by further waves of malicious packages stealing credentials and cryptocurrency, prompting security changes to both registries. Specific date approximate based on reporting.(2025-08-01:requests-secure-v2)event
↯99e838ab
Checkmarx reported packages including AtomicDecoderss, TrustDecoderss, WalletDecoderss, and ExodusDecodes on PyPI, masquerading as wallet recovery tools to steal private keys and mnemonic phrases from Atomic, Trust Wallet, MetaMask, Exodus, and other wallets. Specific date approximate based on reporting.(2024-10-01:requests-secure-v2)event
↯13639402
requests-darwin-lite, a fake requests variant concealing a Golang Sliver C2 framework inside a manipulated PNG logo file, was identified on PyPI after 417 downloads and taken down. Specific date approximate based on reporting.(2024-05-01:requests-secure-v2)event
↯56c682d7
PyPI suspended new project creation and user registration at 02:16 UTC in response to the mass typosquatting campaign. All identified malicious packages were removed the same day.(2024-03-28:requests-secure-v2)event
↯91d8e82f
Over 500 typosquatting variants of popular Python packages including more than 50 targeting the requests library (e.g., reqzests, requzsts) were uploaded to PyPI by an automated campaign carrying zgRAT-linked crypto-stealing payloads.(2024-03-26:requests-secure-v2)event
↯e05c25f4
Zscaler ThreatLabz updates its original blog post on the indirect prompt injection campaigns. No confirmed takedown of debank[.]auction is noted in available sources as of this date.(2026-08-05:debank-auction)event
↯0ec21b22
Broader security press coverage of the campaign continues, with Infosecurity Magazine and other outlets amplifying the Zscaler findings.(2026-07-09:debank-auction)event
↯49550bca
SecurityWeek reports on the Zscaler findings, noting that four of 26 LLMs executed fraudulent crypto payments in testing and that GPT-5.4 and Claude Sonnet 4.5 misclassified the DeBank typosquatting domain as legitimate when lacking a reference source.(2026-07-06:debank-auction)event
↯86af4f98
Zscaler ThreatLabz publishes research documenting debank[.]auction as an active indirect prompt injection campaign targeting AI agents, alongside a companion Python-library impersonation campaign.(2026-07-02:debank-auction)event
↯9fea7a43
The Hacker News publishes analysis arguing that typosquatting has evolved from a user-facing risk to an AI supply chain threat, establishing the broader context for campaigns like debank.auction.(2026-05-01:debank-auction)event
↯13579ff7
DeBank (debank.com), the legitimate DeFi portfolio tracker being impersonated, launches. Exact founding date is approximate; commonly cited as 2018.(2018-01-01:debank-auction)event
Data refreshes within about 10 minutes · All metrics derived from Supabase