GCVE-110-OSM-2026-616

Malicious vscode tasks.json file that delivers malware via GitHooks, when the user opens the repository using visual studio code. Post checkout githook is triggered by tasks.json file. The initial C2 hosted at https[://]gitcheck-commit[.]vercel[.]app/settings/mac[?]flag[=]2 In the second payload attacker switches to another C2 Host https://gitcheckout-six[.]vercel[.]app. Stage 3 payload is fetched from checkmyip-mu[.]vercel[.]app with a POST request sent with a body that contains environment variables accessible to NodeJS. Returned payload passed to eval for Dynamic execution. The final payload returned is Infostealer malware that talks to C2 144[.]172[.]94[.]202/api/. The file hash of this final payload is d17ff05fbd218d542cae5013c479b1ccddae54c3fadda958d14bc566194379ee