X now hosts its own MCP server, letting AI tools like Claude, Cursor, and Grok connect to the platform's API without developers building the integration.
The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.