MALICIOUS (1) campaign cataloged at 2026-06-17(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-06-syncagents¶
During import, package loads embedded native extension module. This library hooks on loading, spawns a new system process and likely attempts to inject the encrypted payload in it for further execution (T1055.012). The code uses heavy analysis evasion techniques. Decrypted payload revealed capabilities to steal all kind of credentials (browsers data, AI tools, env variables, SSH keys, ...), inject code to redirect cryptocurrency transactions, spy-like activities (screenshots, keylogger) and worm-like activities using discovered GitHub tokens to publish malicious code into CI. It establishes persistence in %LOCALAPPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe and also attempts to perform lateral movement in Kubernetes and AWS environments.
Abuse categories¶
clipboard_stealing
Campaign uses clipboard_stealing.
exfiltration_browser_data
Campaign uses exfiltration_browser_data.
exfiltration_credentials
The package attempts to steal credentials, like passwords or API keys.
exfiltration_crypto
The package attempts to steal sensitive cryptocurrency-related data, like wallet keys.
exfiltration_env_variables
Campaign uses exfiltration_env_variables.
exfiltration_ssh_keys
Campaign uses exfiltration_ssh_keys.
infostealer
Activity is typical for information stealers, i.e. by exfiltrate various sensitive data from the victim's environment.
keylogger
Campaign uses keylogger.
native-extension
The suspicious activity is performed in a native module extension
obfuscation
Code uses obfuscation techniques to hide its true purpose.
persistence
Campaign uses persistence.
sandbox-detection
The package contains code to detect if it is running in a sandbox environment.
uses-telegram-bot
Telegram Bot is used for malicious purposes
worm
Campaign uses worm.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.