Developer CLI Token Harvesting

Elgonad .@elgonad

•updated Apr 23, 2026•7•0•300

Detects command-line activity associated with the execution of the Checkmarx compromise payload (mcpAddon.js), which systematically attempts to dump tokens from gh, gcloud, az, and azd CLI tools.