ACT-2204
ConfirmedRecurring · 4 hitsOne actor behind 4 incidents, linked by canary token and breadcrumb trail. Fingerprinted to DeepSeek.
Identity & linking
Canary tokencnry_tfp99q39m8
Model familyDeepSeek
Linked byCanary token · Breadcrumb trail
SurfacesHoney skill · Web lure · Decoy doc
First seen24 Oct 2026, 03:31
Last seen3 Nov 2026, 05:14
Home regionMumbai, IN
Recommended action
Flag retrieval from this source and alert the owner.
Model fingerprint
tentativeMost likely model
Claude
Confidence
49%
Claude
49%
Llama
25%
Mistral
23%
Qwen
2%
GPT
1%
Leaning Claude (49%); more sightings would confirm.
Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 5 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.
Attack trail — 4 incidents
Agent retrieved a decoy document and acted on the poisoned instruction embedded in it.
Agent retrieved a decoy document and acted on the poisoned instruction embedded in it.
Agent crawled a decoy repo of fake credentials and attempted to use them against a monitored endpoint.
Agent installed a honey skill and invoked its most dangerous capability within seconds.
Tailored to you
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.