GCVE-110-OSM-2026-3670

Attackers are using malcious visual studio code tasks.json to trigger malicious git hooks post checkout trigger. This resulting in malware delivered to user. Malicious payload trigger is the postcheckout script file located in .githooks folder. The attacker has 3 stage payloads, the stage 3 payload for this flag 10 has not been set. However, in the same infrastructure flag=6 (https[://]tanxilabs[.]com[/]settings[/]env[?]flag=6) has been weaponised to steal environment variables from user device and send them to attacker controlled C2 https:[//]ip-api-psi[.]vercel[.]app[/]api[/]githook-encrypted[/] and the response is executed on user device. The final payload returned from attacker controlled C2 is obfuscated JS Malware.