3 ms·
> Interestingly, the malware checks for the presence of Claude Code CLI or Gemini CLI on the system to offload much of the fingerprintable code to a prompt. Ca
by grav 1y ago
> Interestingly, the malware checks for the presence of Claude Code CLI or Gemini CLI on the system to offload much of the fingerprintable code to a prompt.
Can anyone explain this? Why is it an advantage?
- NitpickLawyer 1y agoSome AV / endpoint protection software could flag those files. Some corpo deep inspection software could flag those if downloaded / requested from the web. The cc/geminicli were just an obfuscation method to basically run a find [...] > dump.txt Oh, and static analysis tools might flag any code with find .env .wallet (whatever)... but they might not (yet) flag prompts :)
- cluckindan 1y agoThe malware is not delivering any exploits or otherwise malicious-looking code, so endpoint security is unlikely to flag it as malicious.
- skybrian 1y agoThat’s because it’s new. Perhaps feeding prompts into Claude Code and similar tools will be considered suspicious from now on?
- sneak 1y agoFurthermore most people have probably granted the node binary access to everything in their home directory on macOS. Other processes would pop up a permission dialog.