ACT-2200
SuspectedRecurring · 3 hitsOne actor behind 3 incidents, linked by wallet. Fingerprinted to GPT.
Identity & linking
Wallet0x891f1746…4d
Model familyGPT
Linked byWallet
SurfacesARBITRUM · Decoy MCP
First seen10 Sept 2026, 23:07
Last seen28 Oct 2026, 06:03
Home regionTokyo, JP
Recommended action
Revoke the tool token this agent presented.
Model fingerprint
tentativeMost likely model
Claude
Confidence
42%
Claude
42%
Llama
26%
Mistral
24%
Qwen
7%
GPT
1%
Leaning Claude (42%); more sightings would confirm.
Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 4 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.
Attack trail — 3 incidents
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
Tailored to you
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.