Skip to content

MALICIOUS (1) campaign cataloged at 2025-04-03(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-04-colorinsa

Using the color function triggers attempts to exfiltrate browsers data

Abuse categories

action-hidden-in-lib-usage

The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).

exfiltration_browser_data

Campaign uses exfiltration_browser_data.

exfiltration_generic

Campaign uses exfiltration_generic.

typosquatting

The package name is an typosquatting variant of a popular package.

Packages in the campaign

campaign:2025-04-colorinsa