MALICIOUS (1) campaign cataloged at 2026-09-01(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-09-gcphelpit

During initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data.

Abuse categories

files_exfiltration

Campaign uses files_exfiltration.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

• https://github.com/EliyaS-123/gcphelpit-cli/commit/0f330a199020f1f2e896c7bde9d35adbe8aa8fb5

Packages in the campaign

campaign:2026-09-gcphelpit

• gcphelpit