SentinelOnePublished
Don’t Call Us, We’ll Call Your APIs
Excerpt
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors
Resurface on Victim With No Crypto Ties
By Albert Priego, Alex Delamotte & Matej Havranek
Executive Summary
Following disclosure of the TraderTraitor attack against LayerZero Labs in April 2026, SentinelOne identified an additional victim with the same macOS backdoors.
Our analysis explores the mechanics of these backdoors and the expanded targeting against a victim in the IT services sector with no relationship to cryptocurrency trading.
We also identified more weaponized GitHub repositories from the social engineering schemes used…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by SentinelOne on sentinelone.com.
Mentioned in the excerpt
More from SentinelOne3
- Prompts as Code & Embedded KeysSentinelOne · Published 19 Sep 2025
- fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before StuxnetSentinelOne · Published 23 Apr
- Malware Discovered – SFG: Furtim Malware AnalysisSentinelOne · Published 12 Jul 2016
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
