MALICIOUS (1) campaign cataloged at 2026-03-22(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-03-old-utf-cleaner¶
During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execute from a C2 server, as well as periodically sends a beacon to C2 allowing discovery and finishing execution.
This package is closely related to Github repository https://github.com/xcummins/tg-outline-seller/ from the same author, where it's used as dependency effectively compromising its users.
Abuse categories¶
remote_commands
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
remote_script
Downloads and executes a remote malicious script.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://github.com/xcummins/gits -
90.156.226.65