Skip to content

MALICIOUS (1) campaign cataloged at 2026-11-14(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-11-ps-bool

During import, obfuscated code exfiltrates photos and documents to a Telegram bot. It targets Android devices.

Abuse categories

files_exfiltration

Campaign uses files_exfiltration.

obfuscation

Code uses obfuscation techniques to hide its true purpose.

target:android

The package is designed to target Android users or the Android platform.

uses-telegram-bot

Telegram Bot is used for malicious purposes

Packages in the campaign

campaign:2026-11-ps-bool