Tag: linux compromise

2 Attack Reports | 0 Vulnerabilities

Attack reports

Untangling a Linux Incident With an OpenAI Twist (Part 2)

A Linux endpoint was simultaneously compromised by at least two distinct threat actors while the developer user relied on OpenAI's Codex AI agent for security remediation. Actor A deployed a cryptominer mining Monero to a private pool. Actor B installed a multi-revenue botnet including XMRig mining…

credential harvesting

data exfiltration

linux compromise

ai-assisted remediation

multiple threat actors

Published: April 22, 2026

Linked vulnerabilities : CVE-2025-30406, CVE-2025-55182 (CVSS 10.0), CVE-2025-31151

Downloadable IOCs: 3

Untangling a Linux Incident With an OpenAI Twist

A technology sector organization experienced a multi-actor compromise on a Linux endpoint where cryptominers were deployed and credential harvesting occurred. The incident became complex when the legitimate user attempted to troubleshoot suspected malicious activity using OpenAI's Codex AI agent wh…

credential theft

living-off-the-land

linux compromise

Published: April 17, 2026

Linked vulnerabilities : CVE-2025-47812

Downloadable IOCs: 1

Click here to see more Attack Reports