GCVE-110-OSM-2026-636

Attackers are using malicious visual studio code tasks.json to trigger malicious git hooks post checkout trigger. This resulting in malware delivered to user. Malicious payload trigger is the postcheckout script file located in .githooks folder. Payload steals environment variables from user device and send them to attacker controlled C2 server-victory5[.]vercel[.]app[/]api[/]ipcheck-encrypted[/] and the response is executed on user device. The final payload returned from attacker controlled C2 is obfuscated JS Malware.