← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
31,255
Relationships
34,126
Potential duplicates
0
Filter by kind
Entities
↯aa418e1e
Ethereum Fusaka upgrade activates, reducing transaction fees approximately sixfold and removing the primary economic barrier to mass-scale address poisoning campaigns.(2025-12-03:mass-address-poisoning-campaign-ethereum-2025-2026)event
↯37e5c495
Blockaid records approximately 628,000 poisoning attempts in November 2025, representing the pre-Fusaka baseline.(2025-11-01:mass-address-poisoning-campaign-ethereum-2025-2026)event
↯1912f4d4
Blockaid begins tracking address poisoning transactions on-chain; 65.4 million transactions flagged in the subsequent 12+ months at an average of 160,000 per day.(2025-01-01:mass-address-poisoning-campaign-ethereum-2025-2026)event
↯2ce943b4
$68 million WBTC stolen in address poisoning incident; approximately 22,960 ETH partially recovered within one week through deanonymization and negotiation.(2024-05-01:mass-address-poisoning-campaign-ethereum-2025-2026)event
↯11ded7e2
Academic study baseline period begins: researchers later document 270 million address poisoning attempts and $83.8 million in losses across Ethereum and BSC between July 2022 and June 2024.(2022-07-01:mass-address-poisoning-campaign-ethereum-2025-2026)event
□749b64fb
Mass Address Poisoning Campaign (Ethereum 2025-2026)organization
◎b0721d24
expel.comdomain
◎cf15f1eb
akamai.comdomain
◎cd0e97dc
darkreading.comdomain
◎37ca152e
digital.nhs.ukdomain
◎18c960ae
threats.wiz.iodomain
◎8383b5af
securitylabs.datadoghq.comdomain
◎569e205e
reversinglabs.comdomain
◎f6250e3b
unit42.paloaltonetworks.comdomain
↯79e6fbfe
At least 32 packages in the @redhat-cloud-services npm namespace reported compromised via a backdoored GitHub Actions workflow distributing Miasma, assessed as a Shai-Hulud derivative by Unit 42.(2026-06-01:shai-hulud-teampcp-supply-chain-attack)event
↯29133a8d
Mini Shai-Hulud Wave 3: Compromised @antv maintainer account used to publish 639 malicious versions across 323 packages in ~22 minutes (~16 million weekly downloads); largest single-hour package count of any documented Shai-Hulud wave.(2026-05-19:shai-hulud-teampcp-supply-chain-attack)event
↯7ad468ea
TeamPCP publishes Shai-Hulud worm source code to GitHub under MIT License: 'Open Sourcing The Carnage.' Copycat forks and clone packages begin appearing within hours.(2026-05-12:shai-hulud-teampcp-supply-chain-attack)event
↯3b59171b
Mini Shai-Hulud Wave 2 begins at 19:20 UTC: 84 malicious @tanstack package versions published in 6 minutes via GitHub Actions pwn request and OIDC token extraction; worm propagates to 172 unique packages / 403 malicious versions across npm and PyPI within 48 hours. CVE-2026-45321 (CVSS 9.6) assigned.(2026-05-11:shai-hulud-teampcp-supply-chain-attack)event
↯a4fe13f7
Mini Shai-Hulud targets SAP CAP ecosystem: @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and mbt packages compromised (~570,000 combined weekly downloads).(2026-04-29:shai-hulud-teampcp-supply-chain-attack)event
↯2a499fc2
Bitwarden CLI @bitwarden/cli@2026.4.0 compromised for approximately 93 minutes via backdoored Checkmarx GitHub Actions workflow; 334 developer downloads of the malicious version; payload embedded string 'Shai-Hulud: The Third Coming'.(2026-04-22:shai-hulud-teampcp-supply-chain-attack)event
↯ad344902
Shai-Hulud 3.0 'The Golden Path' variant discovered by researcher Charlie Eriksen propagating via @vietmoney/react-big-calendar@0.26.2; dead-man's switch removed from this variant.(2025-12-28:shai-hulud-teampcp-supply-chain-attack)event
↯8b0af543
Malicious Trust Wallet extension exfiltration window closes at 11:00 UTC; Trust Wallet releases clean version 2.69; reimbursement process initiated. Final loss: approximately $8.5 million across 2,520 wallets.(2025-12-26:shai-hulud-teampcp-supply-chain-attack)event
↯4c15f779
Security researchers publicly report wallet drains; Trust Wallet acknowledges incident.(2025-12-25:shai-hulud-teampcp-supply-chain-attack)event
↯c3a916e6
Malicious Trust Wallet Chrome extension v2.68 published at 12:32 PM UTC using stolen Chrome Web Store API key; active wallet mnemonic harvesting begins.(2025-12-24:shai-hulud-teampcp-supply-chain-attack)event
↯ee2a8ba4
Microsoft Security Blog publishes formal Shai-Hulud 2.0 detection, investigation, and defense guidance.(2025-12-09:shai-hulud-teampcp-supply-chain-attack)event
↯ea1d9678
Attacker registers domain metrics-trustwallet[.]com in preparation for Trust Wallet extension compromise.(2025-12-08:shai-hulud-teampcp-supply-chain-attack)event
↯ddb7d153
Shai-Hulud 2.0 peak activity: 640+ npm packages infected within days; 25,000+ data-leaking GitHub repositories created; Zapier, PostHog, and Postman developer tooling among affected parties.(2025-11-24:shai-hulud-teampcp-supply-chain-attack)event
↯f9c6f886
Original Shai-Hulud worm first detected in the npm ecosystem; 500+ packages compromised via malicious preinstall hooks; credentials harvested from 25,000+ GitHub repositories.(2025-09-01:shai-hulud-teampcp-supply-chain-attack)event
□6fb62b93
Shai-Hulud / TeamPCP Supply Chain Attackorganization
◎9567e7f3
securityalliance.orgdomain
◎3cb41c87
sentinelone.comdomain
↯705c3f2a
Bleeping Computer publishes deep-dive on Lucifer Drainer's internal operations, confirming the platform remains live and actively recruiting affiliates as of May 2026.(2026-05-21:lucifer-drainer)event
↯df72f6bc
Documentation domain hosted on Google Firebase suspended following security research exposure. Lucifer Drainer migrates documentation to IPFS, citing decentralization as a takedown-resistance strategy.(2025-11-01:lucifer-drainer)event
↯9ef92dd1
Telegram bans Lucifer Drainer bots. Operators instruct affiliates via channel to create new bots and grant them admin privileges, maintaining continuity.(2025-08-01:lucifer-drainer)event
↯c3c9a299
Lucifer Drainer operators publicly restate the commission-only model: 'We do not sell or lease the software and only split 20% per hit.'(2025-05-01:lucifer-drainer)event
↯393304b0
Lucifer Drainer announces version 6.6.6 featuring ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses, and multichain deployment.(2025-03-01:lucifer-drainer)event
↯df76bcf9
Flare researchers begin collecting and analyzing approximately 700 underground posts from forums, chats, and channels related to Lucifer DaaS; research period spans January 2025 through early 2026.(2025-01-01:lucifer-drainer)event
↯b5626d1a
Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team, consolidating two of the largest DaaS operations.(2024-10-19:lucifer-drainer)event
↯b53a4cc1
Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.(2024-07-17:lucifer-drainer)event
↯3db3a18e
Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.(2024-05-17:lucifer-drainer)event
↯ab3f589c
Inferno Drainer announces shutdown after claiming over $80 million in total theft; later found to have continued operations covertly.(2023-11-01:lucifer-drainer)event
◎04f43b43
charltonsquantum.comdomain
↯054bc9b9
Ray Youssef departs as CEO of NoOnes, a separate P2P crypto platform he founded after leaving Paxful. NoOnes states his legal matters are personal and unrelated to the company.(2026-02-01:paxful)event
↯66d04962
Paxful Holdings, Inc. is formally sentenced by the U.S. District Court, Eastern District of California to pay a $4 million criminal penalty.(2026-02-10:paxful)event
Data refreshes within about 10 minutes · All metrics derived from Supabase