MALICIOUS (1) campaign cataloged at 2026-04-08(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-04-sentinel-tool¶
The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and some remote control possibilities like switching the computer off and grabbing clipboard content. Some content suggests it was designed to be used by the uploader themself, but it poses the risk to anyone installing it.
Abuse categories¶
remote_executable
Downloads and executes a remote executable.
spyware-like
Campaign uses spyware-like.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
hxxps://raw.githubusercontent.com/offc559-crypto/senitel/main/Sentinel.exe