MALICIOUS (1) campaign cataloged at 2026-09-10(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-09-lucy-python-script-2030¶
Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the code contained mistakes effectievly disarming the functionality.
Abuse categories¶
exfiltration_browser_data
Campaign uses exfiltration_browser_data.
exfiltration_cloud_tokens
Campaign uses exfiltration_cloud_tokens.
files_exfiltration
Campaign uses files_exfiltration.
infostealer
Activity is typical for information stealers, i.e. by exfiltrate various sensitive data from the victim's environment.
persistence
Campaign uses persistence.
sandbox-detection
The package contains code to detect if it is running in a sandbox environment.
uses-telegram-bot
Telegram Bot is used for malicious purposes