MALICIOUS (1) campaign cataloged at 2026-10-17(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-10-ukraine69¶
During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion.
Abuse categories¶
covering-tracks
The package contains code to cover its tracks, e.g. by deleting malicious code after execution.
destructive-actions
Campaign uses destructive-actions.