MALICIOUS (1) campaign cataloged at 2026-04-30(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-04-buffparser¶
Described as a utility for gaming, the code starts a reverse shell when using the exposed alledegdly parsing function.
Abuse categories¶
action-hidden-in-lib-usage
The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).
revshell
The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://raw.githubusercontent.com/57459N/test/refs/heads/main/ip.txt -
91.149.191.134