Prevention ID: 4c5dc3ff-e0dd-4cf3-b91a-aac4368fe053 Machine name: Jegors’s MacBook Pro OS Name: OS X 26.5.2 OS Version: 26.5.2 Cortex XDR version: 9.1.1.15248 Dump path: Content Version: 2360-39443 mode: Terminate Module name: Child Process Protection Date: 31/07/26, 06:16:13 PM Verdict: Malware Source Process ID: 65944 Source Process Command-Line: /bin/zsh -c source /Users/jcemisovs/.claude/shell-snapshots/snapshot-zsh-1785439666366-5qh30f.sh 2>/dev/null || true && setopt NO_EXTENDED_GLOB NO_BARE_GLOB_QUAL 2>/dev/null || true && { \builtin unalias — ‘unsetenv’; \builtin unset -f — ‘unsetenv’; } >/dev/null 2>&1 || true && eval ‘scp -q /private/tmp/claude-503/-Users-jcemisovs-Repositories/63527775-c617-42d0-9a0e-611029e761bf/scratchpad/sweep.sh ubuntu@130.61.65.205:/home/ubuntu/sweep.sh ssh ubuntu@130.61.65.205 “chmod +x sweep.sh && ./sweep.sh” 2>&1 | tail -20’ < /dev/null && pwd -P >| /tmp/claude-31a2-cwd Source User Name: jcemisovs Target Process ID: 65958 Target Process Command-Line: ssh ubuntu@130.61.65.205 chmod +x sweep.sh && ./sweep.sh Target User Name: jcemisovs