Search — “webhook.site”

GTIG and Mandiant report PRC-nexus UNC7228 (overlaps STORM-0940) and financially motivated groups operating open-source agentic pentest frameworks (ARTEX, PentAGI, CAIRN, Hexstrike) in real intrusions since late August 2026, with confirmed compromise and data theft. ARTEX used supplied valid credentials to probe Azure/AWS permissions, poison MySQL general_log into JSP webshells, abuse Kudu APIs, Kerberoast/DCSync, and post output to rotating webhook.site URLs via curl. Hunt for 2–25 second bursts of API calls, artex-probe-*/ArtexProbe artifacts, MySQL SET GLOBAL general_log_file changes, and server egress to webhook.site.

Attackers used a leaked, unrevoked LiteLLM Agent Platform master key to steal GitHub OAuth tokens, harvest CI secrets via throwaway-branch workflows exfiltrating to webhook.site, and repoint the release pipeline to a lookalike repo, publishing malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR on 2026-10-21. The wheel drops cook.pth/cook.py/sitecustomize.py into site-packages so any Python start runs the PRIVCOLLECT credential collector, which encrypts loot with OpenSSL in .pc_e_ staging dirs and POSTs to www.litellm.dev/healthcheck; a Unix loader polls a GitHub dead-drop for second-stage code (not confirmed executed). Microsoft observed collector activity on Windows and macOS endpoints. Hunt for Python spawning systeminfo/ipconfig/openssl, connections to litellm.dev, the startup files outside the litellm directory, and /tmp marker/lock files.

Attackers exploited a command-injection flaw (CVE-2026-110447) in proxy.php of Nextcloud's richdocumentscode (Collabora Online Built-in CODE Server) app before 26.4.303. Unauthenticated GET requests to /apps/richdocumentscode/proxy.php?status with $(...), ${IFS} and base64 -d|sh in the path wrote shx*.php web shells, beaconed uname -a to webhook.site, and the shells were then used to search for password vaults and crypto wallets. Hunt access logs for proxy.php?status with %2e%2e, $( or ${IFS}, shx*.php files in the app folder, ?c= requests to them, and sudo attempts by the web server account.