MALICIOUS (1) campaign cataloged at 2026-01-22(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-01-icloud-recovery

On importing the module, the code exfiltrates text files, with the focus on configuration files

Abuse categories

files_exfiltration

Campaign uses files_exfiltration.

Packages in the campaign

campaign:2026-01-icloud-recovery

• icloud-recovery