MALICIOUS (1) campaign cataloged at 2026-07-24(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-07-roles-royce¶
During import, the package exfiltrates sensitive data (env variables, credential files, shell history, cryptocurrency wallet data etc.). It appears to be targeting users of kpk.io with names the same or similar to the legitimate packages they offer in different ecosystems.
Abuse categories¶
dependency-confusion
An attempt to exploit dependency confusion
exfiltration_cloud_tokens
Campaign uses exfiltration_cloud_tokens.
exfiltration_credentials
The package attempts to steal credentials, like passwords or API keys.
exfiltration_crypto
The package attempts to steal sensitive cryptocurrency-related data, like wallet keys.
exfiltration_env_variables
Campaign uses exfiltration_env_variables.
exfiltration_ssh_keys
Campaign uses exfiltration_ssh_keys.
targetted-attack
Campaign uses targetted-attack.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
185.158.107.189 -
151.247.22.13 -
hxxp://185.158.107.189:8877 -
hxxp://151.247.22.13:8877