AliceLabs admits LLM draft of disputed taikotalent.xyz report

AliceLabs told oss-security its taikotalent.xyz fake-recruiter takedown post was LLM-assisted, while a moderator has not confirmed the malware details.

On 15 October 2026, an oss-security follow-up claimed a fake-recruiter campaign using taikotalent.xyz and "Engineering opening - Taiko" emails had been resolved after the registrar placed the domain on clientHold on 10 October 2026. That post described a paste-in-terminal bash stager named deepfake_guard (49,916 bytes, SHA-256 beginning c7c22e322c), C2 at api.gaganata.ink, a base64 second stage written to /var/tmp/.kdm.*, and anti-forensic self-deletion. The same day, Solar Designer said the follow-up looked AI-generated, that nothing about the incident had previously been disclosed on the list, and that no exploitation, indicators, or malware details were confirmed, though the domain exists, was registered recently, and was last modified on 2026-10-10, so the incident might still be real. On 17 October 2026, AliceLabs replied that the domain was resolved by the 10 October clientHold, accepted process corrections, and said the earlier follow-up was drafted with LLM assistance that should have been disclosed; future AliceLabs posts will declare LLM assistance. That reply names no CVE and does not describe ongoing exploitation. The sources still disagree on verification: AliceLabs treats the takedown as resolved, while Solar Designer has not confirmed the malware claims.

• On 15 October 2026 an oss-security follow-up claimed fake "Engineering opening - Taiko" emails used taikotalent.xyz to deliver a paste-in-terminal bash stager.
• That post named the stager deepfake_guard (49,916 bytes, SHA-256 beginning c7c22e322c), C2 api.gaganata.ink, a base64 second stage at /var/tmp/.kdm.*, and anti-forensic self-deletion.
• The post and its title said a registrar clientHold on 2026-10-10 suspended taikotalent.xyz and resolved the campaign.
• Solar Designer said the follow-up looked AI-generated, that nothing about it had previously been disclosed on the list, and that exploitation, indicators, and malware details were not confirmed.
• He noted the domain exists, was registered recently, and was last modified on 2026-10-10, so the incident might still be real.
• On 17 October 2026 AliceLabs said the earlier follow-up was drafted with undisclosed LLM assistance during incident response and that future AliceLabs posts will declare LLM assistance.
• AliceLabs still says the 2026-10-10 clientHold resolved the domain; the reply names no CVE and does not describe ongoing exploitation.