Date: 11/12/2026
Severity: High
Summary
The team uncovered a targeted supply chain attack against multiple cryptocurrency wallet providers, carried out through a GitHub account named sapho11. The campaign combines a Rust-based dependency confusion technique, coordinated GitHub pull requests, and phishing attempts against software maintainers. So far, Keplr, Zcash, Vizor, and Cosmos have been identified as targets. Within hours of creating the account on November 10, 2026, the attacker submitted six pull requests, published eight credential-stealing Rust crate versions on crates.io, staged a Node.js stealer, and used a fake security disclosure to target two Vizor maintainers.
Indicators of Compromise (IOC) List
Domains/URLs | https://api.sdklfghaljksdhfkjasdfhlkasdhfjklasdf.xyz/v1/tipcheck https://api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz/v1/tipcheck https://session-check.sapho11.workers.dev/v1/tipcheck https://session-check.sapho11.workers.dev/auth https://session-check.sapho11.workers.dev/auth/login https://webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1 |
Hash | 129be19ca4d1d997d168af561e5cea12b0a401716a05720daf48072e470d7db5
10304aa2c167bb0d66800020fb1f983bc62bb5bec89239de9fddb129b523149a
6d35f023e3d87f8d4bc91a3bc670ae4681e9d85937146b9b0683d0f33eb0f55a
80c54ff4fe231c363db0c75cbb81f566ea4d10c266ec594165d840df13ab0973
476a207e057ec463ff045a2c0115c8a34ea8eab70e0abe4c1efd90ceb8b5161c
3b290a899d741be14f9bb9f3545279911f774608362f348654f10823774c2f87
5c848823a78313c47596bdf3c260e8862a02c7e48fa8ce718aca332f7b80c4fd
7c0fbaf582b9b4e674c108ed5b0cb2835b11369fbdb1ce7ac29d63e9321a6981
f466d5621525a4cf229e4a8377cd7285da5797eee77384253f1040a722765953
ac82fd28228bfb55acbb9bfdd2f3a4b926c6d65e2965db5a34c11d1a76fbd762
c469240c313d7da0d40b901e51e642b4efd61906e28849c1059b70451065ccca
d8671b8aed8771dba6b57bd51d2e42914c0df87bd9e9d148478a0fbc121e81e6
|
Email Address | sapho11@wp.pl |
Github Account | github.com/sapho11 (ID 354695800) |
Malicious Packages | crates/lwd-uri-util@0.1.0 crates/lwd-uri-util@0.1.1 crates/lwd-uri-util@0.1.2 crates/lwd-uri-util@0.1.3 crates/lwd-uri-util@0.1.4 crates/lwd-uri-util@0.1.5 crates/lwd-uri-util@0.1.6 crates/lwd-uri-util@0.1.7 |
Malicious Repositories | https://github.com/sapho11/lwd-uri-util https://github.com/sapho11/zip321-uri https://github.com/sapho11/zec-uri |
Malicious Pull Requests | https://github.com/chainapsis/vizor-wallet/pull/1199 https://github.com/chainapsis/vizor-wallet/pull/1200 https://github.com/chainapsis/vizor-wallet/pull/1201 https://github.com/chainapsis/vizor-wallet/pull/1202 https://github.com/zingolabs/zingo-common/pull/85 https://github.com/zingolabs/zingolib/pull/3148 |
Commits With Original (Unredacted) Payloads | chainapsis/vizor-wallet@c675b967588f370a1eace7c73b81f82343b29486 (PR #1199) chainapsis/vizor-wallet@716e01d64b36c40b0cd4e6f7e4e813ed792388da (PR #1200) chainapsis/vizor-wallet@a1762b9db1a4207ab0d823556c50fe86ea1dfd43 (PR #1201, AGENTS.md) |
Environment Variable Kill Switches | LWD_URI_NO_METRICS LWD_URI_METRICS_URL ZIP321_NO_TELEMETRY VIZOR_DIAG_ENDPOINT VIZOR_TIP_MIRROR |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://session-check.sapho11.workers.dev/auth" or url like "https://session-check.sapho11.workers.dev/auth" or siteurl like "https://session-check.sapho11.workers.dev/auth" or domainname like "https://api.sdklfghaljksdhfkjasdfhlkasdhfjklasdf.xyz/v1/tipcheck" or url like "https://api.sdklfghaljksdhfkjasdfhlkasdhfjklasdf.xyz/v1/tipcheck" or siteurl like "https://api.sdklfghaljksdhfkjasdfhlkasdhfjklasdf.xyz/v1/tipcheck" or domainname like "https://session-check.sapho11.workers.dev/auth/login" or url like "https://session-check.sapho11.workers.dev/auth/login" or siteurl like "https://session-check.sapho11.workers.dev/auth/login" or domainname like "https://webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea" or url like "https://webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea" or siteurl like "https://webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea" or domainname like "https://api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz/v1/tipcheck" or url like "https://api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz/v1/tipcheck" or siteurl like "https://api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz/v1/tipcheck" or domainname like "https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1" or url like "https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1" or siteurl like "https://webhook.site/14b3cc9b-3275-4b63-8b93-f4d2669fbdc1" or domainname like "https://session-check.sapho11.workers.dev/v1/tipcheck" or url like "https://session-check.sapho11.workers.dev/v1/tipcheck" or siteurl like "https://session-check.sapho11.workers.dev/v1/tipcheck" |
Detection Query 2 : | sha256hash IN ("129be19ca4d1d997d168af561e5cea12b0a401716a05720daf48072e470d7db5","7c0fbaf582b9b4e674c108ed5b0cb2835b11369fbdb1ce7ac29d63e9321a6981","5c848823a78313c47596bdf3c260e8862a02c7e48fa8ce718aca332f7b80c4fd","476a207e057ec463ff045a2c0115c8a34ea8eab70e0abe4c1efd90ceb8b5161c","10304aa2c167bb0d66800020fb1f983bc62bb5bec89239de9fddb129b523149a","3b290a899d741be14f9bb9f3545279911f774608362f348654f10823774c2f87","6d35f023e3d87f8d4bc91a3bc670ae4681e9d85937146b9b0683d0f33eb0f55a","80c54ff4fe231c363db0c75cbb81f566ea4d10c266ec594165d840df13ab0973","f466d5621525a4cf229e4a8377cd7285da5797eee77384253f1040a722765953","ac82fd28228bfb55acbb9bfdd2f3a4b926c6d65e2965db5a34c11d1a76fbd762","c469240c313d7da0d40b901e51e642b4efd61906e28849c1059b70451065ccca","d8671b8aed8771dba6b57bd51d2e42914c0df87bd9e9d148478a0fbc121e81e6")
|
Detection Query 3 : | sender like "sapho11@wp.pl" or recipient like "sapho11@wp.pl" or from like "sapho11@wp.pl" |
Reference:
Malicious Rust Crate Targets Crypto Wallet Developers