Skip to content

MALICIOUS (1) campaign cataloged at 2025-08-12(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-08-kertash

When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used to perform action user requested, deobfuscation reveals exfiltrating user's data instead.

Abuse categories

action-hidden-in-lib-usage

Campaign uses action-hidden-in-lib-usage.

exfiltration_generic

Campaign uses exfiltration_generic.

obfuscation

Campaign uses obfuscation.

webhook:telegram

A Telegram webhook is used to send collected data.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://raw.githubusercontent.com/0xPwnme/kertash/refs/heads/main/kertash.py

Packages in the campaign

campaign:2025-08-kertash