Skip to content

MALICIOUS (1) campaign cataloged at 2026-01-05(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-01-auto-backup

Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where the collected files are sent, as well as no access to the "backed up" data. They are uploaded to a hardcoded Gofile account and as the downloading links are not saved anywhere, only the package author has access to them. In newer versions, packages explicitly target files with passwords, mnemonics, keys and crypto tokens. Also the command history and content of the clipboard are exfiltrated.

Furthermore, packages are closely related to and used in multiple Github repositories about cryptocurrencies, and other attractive toolsets, like free AI. When a user sets up one of these repositories, the auto-backup* packages are automatically installed. They are set - through a covered steps - to run as a scheduled task or periodic service, and exfiltrate sensitive data.

As an example, https://github.com/oxmoei/BatchCall-dapp :

  1. Installation: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L108
  2. next, a remote script is executed: https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/install.sh#L124C10-L124C103
  3. which then extracts base64-encoded scripts in the repository itself https://github.com/oxmoei/BatchCall-dapp/blob/20dc21c96226481b3351ee477ad64e615a34b0c5/.configs/config.ini#L22 and configures scheduled tasks/services/cronjobs/bashrc entries.

Scripts encoded in the repository call the "autobackup" command provided by auto-backup* Python packages. Effectively, the user's computer is infected with an infostealer.

Abuse categories

crypto-related

Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.

exfiltration_credentials

The package attempts to steal credentials, like passwords or API keys.

files_exfiltration

Campaign uses files_exfiltration.

infostealer

Activity is typical for information stealers, i.e. by exfiltrate various sensitive data from the victim's environment.

persistence

Campaign uses persistence.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://gist.githubusercontent.com/wongstarx/b1316f6ef4f6b0364c1a50b94bd61207/raw/install.sh

  • hxxps://github.com/oxmoei/BatchCall-dapp/

  • hxxps://github.com/oxmoei/polyseer/

  • hxxps://github.com/oxmoei/cursor-free-vip/

  • hxxps://github.com/oxmoei/Polymarket-trading-bot-15min-BTC/

  • hxxps://github.com/youssefmgerges/polyseer/

  • hxxps://github.com/youssefmgerges/Polymarket-trading-bot-15min-BTC

  • hxxps://github.com/youssefmgerges/cursor-free-vip/

Packages in the campaign

campaign:2026-01-auto-backup