lambsys/isp.sh cryptominer chmod on dropped binaries in /tmp and /var/tmp

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•7

Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.