MALICIOUS (1) campaign cataloged at 2025-05-19(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-05-ai-labs-snippets-sdk¶
During the importing, it loads a file pretending to an AI model. This file contains pickle-serialized code that exfiltrates data (basic IP/username info, as well as .gitconfig) to a remote target.
Abuse categories¶
basic_exfiltration
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
exfiltration_generic
Campaign uses exfiltration_generic.
impersonation
Campaign uses impersonation.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
aksjdbajkb2jeblad.oss-cn-hongkong.aliyuncs.com