Skip to content

MALICIOUS (1) campaign cataloged at 2025-09-02(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-08-doxer

During installation a screenshot is exfiltrated, and the package has no other purpose

Abuse categories

exfiltration_generic

Campaign uses exfiltration_generic.

other

Campaign uses other.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://discord.com/api/webhooks/1412207208716046388/DTGzSgfACyOBNH1wJcdUvulnp1KA03YFfXR7KTno_QSNlSABNascutSUy9GT5phsPoXL

Packages in the campaign

campaign:2025-08-doxer