🚨 Threat Intelligence | The StealC Info-Stealing Chain Behind the Qwen Impersonation Repository
SlowMist Security Team identified a #
GitHub# repository impersonating local quantized weights for Qwen 3.8 27B. A real Q4_K_M 27B package should exceed 16 GB. The asset delivered was only 487 KB — no GGUF weights, just three files: Application.cmd, a renamed LuaJIT interpreter, and an obfuscated Lua script disguised as cert.txt.
The official #
Qwen# project was not compromised. The repo kept the look of a normal offline model project, while the malicious ZIP sat in assets/. After deobfuscation, the script collects host data, takes a screenshot, and POSTs them to C2. When the hardcoded server fails, it reads a fallback C2 from a Polygon contract via eth_call, so operators can rotate infrastructure with a single on-chain transaction.
Preserved C2 responses then delivered an inner payload we attribute to #
StealC#, targeting:
🔹 Browser logins, cookies, and history — including a Chrome App-Bound Encryption bypass
🔹 Email, WinSCP, and Steam credentials
🔹 Wallet-related files and extension data, dispatched by server-side tasks
MistEye reconstructed the multi-stage chain and compared 29 similar ZIPs across 23 repositories using the same Lua delivery stack. Between two collection dates, repositories, filenames, the outer PE, and the AES key had already rotated.
A 27B model that downloads in 487 KB is not a model. Inspect asset size and unpack downloaded packages before running them.
Read the full analysis 👇
显示更多
A TON OF THINGS HAPPENED IN THE STOCK MARKET TODAY.
Here's a full recap:
1. The U.S. reportedly offered Iran a deal to halt the siege and lift sanctions in exchange for reopening the Strait of Hormuz and ending proxy attacks, according to Al Arabiya. Axios also reports that Rubio told several foreign counterparts the U.S. does not plan new strikes on Iran for now, with pressure shifting toward the naval blockade and new sanctions campaign instead. Crude Oil fell 4% and the 10-year treasury bond fell from 4.72% to 4.62%.
2. Global physical gold-backed ETFs $GLD attracted $6.4B of inflows last week, their largest weekly intake since January and the 3rd-largest weekly inflow on record. North America led with $4.4B, followed by Europe at $1.7B and Asia at $300M. This marked the 7th straight week of inflows, with global gold ETFs pulling in $16.4B over that stretch. Total AUM in global gold ETFs rose by $33B last week to $615B, the highest level since the second week of May.
3. Intuit $INTU reported Q4’26 revenue of $4.4B, beating estimates of $4.27B and up 14% YoY. Adjusted EPS came in at $4.03 versus $3.58 expected. Global Business Solutions revenue rose 14% YoY to $3.4B, the Online Ecosystem grew 17% YoY to $2.6B, Consumer revenue increased 14% YoY to $930M, and Credit Karma revenue rose 16% YoY to $743M. For FY27, Intuit guided revenue to $23.3B–$23.5B versus $23.72B expected, while adjusted EPS guidance of $22.88–$23.12 came in well below the $27.32 estimate. The company also raised its dividend 15% YoY to $1.38/share, bought back $5.5B of stock, and has $7.9B remaining on its authorization. Management said its strategy is to win as an AI-driven expert platform while staying disciplined on investments and scaling its big bets.
4. President Trump said the U.S. Navy has removed and/or detonated all mines from international waters in the Strait of Hormuz. He said Iran has been notified that any ship or boat placing new mines will be “immediately and systematically destroyed.” Trump added that Space Force is monitoring every square inch of the Strait, along with Pickaxe Mountain and the three previously destroyed nuclear sites, and said a “Zero Tolerance” policy on mine placement is now in full effect.
5. Canada is responding to U.S. tariffs with new tariffs of its own. The country is raising steel tariffs to 50% from 25%, while roughly 700 products will face new tariff rates of 15%, 25%, and 50%. The measures are set to take effect on September 8, marking another escalation in the U.S.–Canada trade dispute.
6. Anthropic is expected to tell IPO investors its total addressable market exceeds $30T, topping SpaceX’s $28.5T estimate, according to WSJ. The figure represents the potential value of work Anthropic believes AI models could eventually perform, not a direct revenue forecast. Anthropic generated $11.6B in Q2 revenue and could seek to raise as much as $100B at roughly a $2T valuation. IPO documents are expected within weeks, potentially setting up a September or early October listing.
7. OpenAI’s data-center head Chris Malone left the company last week, according to WSJ. Malone joined in March 2025 shortly after Stargate was announced and played a key role overseeing OpenAI’s massive data-center buildout. He previously led data-center strategy at Meta and earlier worked on data-center technology at Google. The departure comes just weeks after OpenAI also replaced its chief revenue officer, adding another senior leadership change as the company races to scale infrastructure, revenue, and compute capacity.
8. ClickHouse has surpassed $350M in annual recurring revenue, up 40% since May, as AI agents drive demand for database and observability infrastructure. OpenAI’s usage has reportedly grown roughly 10x over the past year to more than 30 petabytes of data per day, or around 30T events daily. OpenAI has also shifted parts of its log-management workload from Datadog to ClickHouse over the past year. ClickHouse was valued at $15B in January and says gross margins currently range from 50%–70%. Earlier this year, the company acquired Langfuse to expand deeper into monitoring AI applications and agents. Nebius $NBIS owned a 28% stake in ClickHouse as of May 2025, though that stake has likely been diluted by subsequent fundraising.
9. JPMorgan reiterated its Overweight rating on SpaceX $SPCX with a $240 price target, saying the company’s AI ambitions are coming into sharper focus and that it is increasingly positive on Grok. The firm highlighted SpaceX’s completed acquisition of Cursor on 8/14 as an important step in building enterprise AI capabilities. Cursor brings roughly $4B of ARR as of June 2026, with about 75% coming from businesses, which JPMorgan says should help streamline go-to-market and provide valuable model-training data. The firm also said Cursor data is already showing up in Grok’s supplemental training, with tangible improvements in recent model performance.
10. OpenAI says its new Broadcom-built Jalapeno AI chip outperformed Nvidia $NVDA GB300 in both throughput per watt and response latency during internal testing, according to Bloomberg. The chip is built specifically for inference, not training, and runs at roughly 700 watts. OpenAI plans to begin deploying Jalapeno for its models later this year, saying the performance gap widened on larger workloads, including Moonshot’s Kimi model, and that the chip has also performed well on unreleased OpenAI models. The key caveat is that Jalapeno was tested against GB300, not Nvidia’s newer Vera Rubin generation. OpenAI says a second-generation chip is already nearing tape-out, while work on a third generation has begun.
11. The top 10 most active options today by contracts traded were $NVDA with 1.8M contracts, $TSLA with 1.8M contracts, $AAPL with 636K contracts, $SPCX with 548K contracts, $INTC with 540K contracts, $AMZN with 498K contracts, $MU with 483K contracts, $AMD with 403K contracts, $PLTR with 361K contracts, and $SOFI with 359K contracts.
12. Raymond James raised its Nvidia $NVDA price target to $352 from $330 and reiterated a Strong Buy rating. The firm says Nvidia’s CPU opportunity is becoming more important, especially for agentic AI workloads, even though CPUs are only about 3% of sales today. Raymond James expects CPU revenue to reach roughly 5% of total revenue by CY28 and believes Nvidia could potentially become the world leader in CPU revenue within several years. The firm also argued the stock remains inexpensive, trading at less than 15x CY27 GAAP earnings, below the S&P 500 at 18.6x, despite sales and net income growth still expected to exceed 20% in CY28. Its new $352 target is based on a 22x multiple on CY28 estimates, which Raymond James views as conservative given Nvidia’s leadership, CUDA moat, GPU performance, free cash flow, and history of trading at much higher multiples.
WALL STREET IS THE GREATEST SHOW ON EARTH.
显示更多
The machine economy does not begin when robots get smarter. It begins when a machine can be paid to do something, and every party involved can prove what happened.
Made with
@FabricFND. Two systems meet in the middle of it: Agent Passport issues the agent a verifiable identity and a spending authority its owner defines, and RoboPay actuates a robot after the payment behind the request checks out.
What happens before the robot moves:
▷ Authority is granted once, and it is bounded. The human signs a spending session with a passkey: a total budget, a per-transaction ceiling, the assets allowed, and an expiry. The agent holds no card number and no wallet key. It holds a delegation it cannot exceed.
▷ Two payments, because these are two different obligations. One settles with the merchant for the goods. A separate x402 payment pays the robot for the work of moving them. Buying a thing and hiring a machine to carry it are not the same transaction, and the receipt keeps them apart.
▷ Verification comes before motion. The request arrives with an x402 payment header. The facilitator checks the network, the price, the payee wallet, and the signed payload. Only then are the transaction details sealed onto the robot action event and the command published. Until that clears, the robot sits still.
▷ Every step leaves a receipt. Identity, scope, approval, both payments, verification, dispatch. When you need to know why a machine did something, the answer is a record rather than a guess. (This run was executed in a demo environment.)
Agents have been paying for software for a while now. Paying for physical work is a harder problem, because a delivery cannot be rolled back. The guarantee has to sit in front of the action instead of behind it. Authorization before payment, payment before motion: that ordering is what makes it safe to let autonomous systems spend in the world we live in. It is also the layer the machine economy has to get right before anything else in it can work.
Scoped by Kite. Verified by RoboPay. Delivered in the real world. 🪁
显示更多