Background

Download an open-source large model. The usual things you worry about are whether it runs properly and whether the weights are real. This time, the real concern is hidden elsewhere: a repository labeled with 27B parameters that, when it gets into your hands, only contains 487 KB—inside there are not weights, but a data-stealing trojan horse.

On August 20, 2026, the GitHub repository unburdened-jackinthebox365/qwen38-uncensored submitted a file named uncensored_qwen_v2.6.zip to the assets/ directory. The file size was 487,153 bytes. The repository packaged it in a way that was almost airtight. The homepage claimed to provide locally quantized weights for Qwen 3.8 27B. The README emphasized fully offline operation, no telemetry, and that no data leaves your machine. Every line hit the exact concerns of local model users. Four days later, on August 24, the README was modified again—the download button, the download link in the body, and even the two external links that originally pointed to the Ollama and LM Studio official websites were all changed to point to the raw address of the same ZIP.

At this point, the flaw is obvious. A Q4_K_M quantized model with 27B parameters is typically written to disk as more than 16 GB, and the message printed by the repo’s bin/install.cjs also says about 16.8 GB. But the asset actually delivered is only 487 KB. After decompression, there are only three files—Application.cmd, util.exe, and cert.txt—with no GGUF weights.

Based on this, we judge it to be a spoofed repository that distributes files in the name of Qwen; the official Qwen project has not been compromised. The repository’s Node.js installation script appears to implement a “write Modelfile → call ollama create” workflow. This time, we did not perform dynamic verification. The repository’s main code maintains a normal project appearance; the malicious ZIP is submitted as a downloaded asset under assets/. If you only check the regular source code without unpacking the downloaded assets, you may miss this entry point.

This article is mainly based on static evidence and does not run any samples. C2 requests are reproduced using simulated host data; only responses are read and payloads downloaded—no downloaded content is executed, and no final upload endpoint is accessed. The behavioral descriptions in the text indicate that the code contains corresponding implementations or call paths, but they do not prove that these actions occurred on a real host.

MistEye response

MistEye is a Web3 threat intelligence and dynamic security monitoring system developed independently by SlowMist. It integrates security monitoring and intelligence aggregation capabilities, providing users with real-time risk alerts and asset protection.
In this incident, MistEye completed static analysis of the bait repositories, downloaded assets, and subsequent payloads. It reproduced the C2 requests using simulated host information, saved the responses and download evidence, restored the multi-stage deployment chain, and extracted network and file IOCs. On August 26, it re-checked the C2 liveness and distribution infrastructure rotation, and also performed offline behavioral comparisons on 29 similar ZIPs distributed across 23 repositories. The related IOCs have been ingested into the MistEye threat detection engine.

The following is a detailed technical analysis.

Three files in the 487 KB download package

The entirety of Application.cmd is a single command:

start util.exe cert.txt

Including the newline, it is 25 bytes. It does not decompress any model or call Ollama. It only has util.exe in the same directory read a text file; control is then handed to the Lua script in cert.txt. The compressed package contains no other files—these three are the entire contents.

util.exe is 759,808 bytes and is a renamed LuaJIT 2.1 interpreter. LuaJIT itself is a Lua runtime used by a large amount of legitimate software. The PDB path left in the PE is D:\a\defold\...\luajit.pdb, pointing to Defold game engine packaged output. Static analysis did not find any malicious behavior in util.exe that does not rely on scripts; this file only executes the obfuscated Lua in the same directory.

The name “cert.txt” looks like a certificate; its content is a single-line Lua script of 182,116 bytes. The entire script contains no newline characters; all strings are split into decimal escapes and lookups. If you read it directly, you only see a bunch of numbers and short variable names. Below is a small snippet from the beginning. For readability, we wrap it by statements and truncate the end with an ellipsis:

The first two functions are responsible for fetching characters by index and rearranging the order. Starting from the third line is the scattered string table. The hundreds of plaintext strings in the script are stored in this format and are assembled back at runtime.

Therefore, the risk entry is not on the so-called model program. What the archive provides is a general-purpose interpreter plus some text—the malicious logic all resides in cert.txt.

The C2 response completes the subsequent deployment chain

After offline deobfuscation, cert.txt’s structure becomes clear. It maintains a string table of several hundred entries; all plaintext is split into numeric escapes, and is restored byte-by-byte at runtime. The script uses LuaJIT FFI to parse and call Windows APIs such as VirtualAlloc and CreateThread.

The loader has built-in ID 845. After startup, it collects the hostname, username, GUID, and system version. It uses BitBlt to capture a screenshot and saves it as a BMP, then requests one geolocation lookup from an IP-location interface. It combines these into a multipart POST request to the hardcoded 217[.]119[.]129[.]122. Below is the request we reconstructed after rebuilding the script:

The string after /api/ in the path decodes to the client ID 517b7c5e5663656a057f. The screenshot is placed in the file section: beginning with “BM” indicates the BMP file header. Host information is placed in the data section; both are in the same request. After decoding, data contains simulated values like computer=SIMULATED-PC&user=simulated-user&query=203.0.113.10, which do not correspond to any real host.

Tasks issued by the server are handled separately by extension name; they cover four types: in-memory directly executed payloads, standalone programs, DLLs, and scripts. A single loader can handle almost all common payload formats. The scripts also include Defender exclusions, scheduled task persistence, and task-completion reporting—these three items are placed in conditional branches and are triggered only based on loader configuration from the server and local conditions. In the configuration obtained this time, only persistence is enabled; the others are off. These are conditional-trigger features and do not mean the corresponding actions have already been completed on a real host.

When the hardcoded address becomes invalid, the loader has another fallback path. It makes one eth_call to the Polygon chain, reads the return value of selector 0x3bc5de30 on contract 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, and parses the backup C2 from it. In our test, it decoded to 194[.]48[.]248[.]94:

The 0x14 length prefix is 20, which exactly equals the number of characters in the decoded address; the two match each other. This hex does not have to rely on our decoding script—checking the ASCII table lets you verify it independently. Among the five RPC endpoints configured in the script, three returned the above data exactly byte-for-byte; one required a paid subscription and one directly rejected it. After writing the address into the public-chain contract, switching servers only requires sending a transaction. Simply banning the current备用 IP (backup IP) cannot stop the contract from returning new addresses.

After correcting the request format in the comparison script, the simulated beacon for 845 received HTTP 200 with a 1,248-byte JSON response.

The response fields are encoded in three layers. The decoding direction is Base64 → lowercase hex → 32-byte cyclic XOR. The XOR key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn is hardcoded in the script. The two sections below show the same response before and after decoding; each excerpted part includes only the first 56 characters:

Decoded output is a loader strategy and a task:

The pump field controls whether to use random data to expand the dropped file to the server-specified size. In the current task, this switch is off.

The task downloads a file named `tool.log` to `%TEMP%\dist.lua` and executes it. This file is 396,616 bytes and consists of ASCII hex throughout. Hex decoding and then XOR yields an obfuscated Lua payload of 198,308 bytes. This is the second loader, ID 847. Its initial C2 is changed to `217[.]119[.]129[.]97`; the obfuscation layout is isomorphic to 845. After executing the 847 loader with the same simulated host data, it initiates a beacon to `217[.]119[.]129[.]97`. The server returned two tasks.

In the two tasks, one is still `tool.log`, and the other points to `verb.log` in the same repository. The landing path is written as `AppData\..\Local\Programs\Chromium\Application\Chromium.exe`. The middle `..` traverses the path to LocalAppData, and the final filename is disguised as the Chromium browser main executable.

tool.log, verb.log, and the two subsequent PEs all come from the C2 response and the downloaded files saved to disk; the original ZIP does not contain these files. What the ZIP itself proves is that the loader has download-and-execute capability. The saved C2 responses show that at the time of collection, the server sent follow-on download tasks to the loaderId 845.

StealC payload decoded from verb.log

Unpacking and loading

verb.log 3,089,408 bytes; likewise, it is ASCII hex. The transformation chain is hex/XOR → outer PE → Base64URL/AES → inner PE. Using the same XOR key to decode yields a 1,544,704-byte 64-bit outer PE. Decoding the Base64URL text in its resource section results in an AES-256-ECB ciphertext of 797,728 bytes. The key bFYh8UMQGZOBUlvrpS3M4ZJybbubVbvg is derived from two constant byte arrays embedded in the outer PE; it can be statically recovered. Decryption produces a second 64-bit PE of the same size, 797,728 bytes.

The outer PE manually maps the inner PE within its own process: allocating memory, copying headers and sections, fixing relocations and the import table, creating a thread, and starting at the entry point. There is no inter-process injection API such as CreateProcess, WriteProcessMemory, SetThreadContext, or ResumeThread in the static call chain—the entire process is reflective loading within a single process.

Environment check

The inner payload first checks the environment: if the system default language matches one of Russian, Ukrainian, Belarusian, Kazakh, or Uzbek, it exits. Then it uses a naming Event constructed from host information for single-instance control, and revalidates the embedded expiration date. Only after everything passes does it enter the main logic.

Collect target

• Browsers: Chrome, Edge, Brave obtain login data, cookies, history, and related databases; Firefox calls the NSS interface to decrypt saved login information. When the database is locked, use Restart Manager to end the process holding it.

• Email and operations: Foxmail and Outlook account credentials; WinSCP session information. The WinSCP session directly corresponds to the server accessible to the victim.

• Steam: login configuration, tokens, and sentinel files.

Starting from Chrome 127, cookies and saved passwords are protected by App-Bound Encryption; the keys are escrowed in a system-level service. Copying only the database files cannot obtain plaintext. For this, the payload includes an auxiliary PE that uses Early-bird APC injection to send into a suspended chrome.exe, brave.exe, or msedge.exe. The auxiliary module reads the encrypted App-Bound Key inside the browser process, and exports a 32-byte plaintext key through the COM Elevation Service interface corresponding to each browser, making the previously collected database files readable again.

Wallet collection is fully driven by the server: a recursive collector dispatches file tasks issued by the C2 by type. In the wallets branch, it looks up the local directory by task name and file name. The C2 can also send an extension ID to collect the corresponding Chromium extension’s storage and IndexedDB. The sample plaintext contains no wallet brand name or installation path, and no implementation for mnemonic phrases such as BIP39 or secp256k1 private-key parsing. Which wallet to collect is determined by the server when it sends the task; the static sample list does not include this round’s target inventory.

Upload and attribution

The payload also includes functionality such as taking screenshots, collecting system information and process lists, performing secondary download execution using PowerShell, privilege escalation, and self-deletion on exit.

Data uploads are done via JSON POST with 512 KiB chunking. The upload endpoint is first RC4-encrypted in the file and then saved as Base64. Decrypting it with the configuration key 55uUe45tr1x1xy1lSK yields http[:]//89[.]169[.]12[.]194. The request body is encrypted using a separate RC4 key as well.

StealC is a Windows information-stealing trojan specialized in stealing browser credentials, cookies, encrypted wallets, and other sensitive data, and sending them to the attacker’s C2. The inner payload’s collection scope, App-Bound decryption helpers, the wallet branch, and RC4-encrypted uploads all match StealC’s known characteristics; therefore, we classify it as StealC.
If these materials are successfully obtained, the consequences vary: browser cookies associated with logged-in sessions are taken over; email and Steam credentials lead to loss of accounts; WinSCP sessions correspond to the servers maintained by the victim’s operations. Once a wallet’s private key or mnemonic words are leaked, asset transfers cannot be rolled back.

Re-check and confirm that the distribution infrastructure is rotating

On August 26, we re-sent the three beacon messages again using the same simulated host data. All three endpoints returned HTTP 200, and the loader strategy field remained unchanged word-for-word. The change appears only in the download addresses inside the tasks.

vs.log and the old tool.log are byte-for-byte identical except for the name. The 847 loader is unchanged. After decoding ssl.log, it is a new version of the outer PE with size 1,539,072 bytes; both the entry address and image size have changed. The AES key is rotated accordingly to yK8-eM8KFA8Hl8cCybERmOLZupFvfCNZ.

The inner payload decoded with the new key is still 797,728 bytes. Byte-by-byte comparison with the old version shows only one difference in the entire file: the build number reported to the server changed from build5 to build1. The upload endpoint, RC4 configuration key, and request-body key are all identical.

Switching repositories, changing file names, updating the outer PE, and changing the AES key cause the exact hashes of old files to become invalid. Whether stable structure and behavioral characteristics are still detectable requires verification using specific rules. The actual credential-stealing payload itself remained stable over these two days—only a version label changed. This is an observation between two collection days and is insufficient to determine whether it remains unchanged for a longer period.

More malicious GitHub repositories

We additionally collected 29 malicious ZIP samples distributed across 23 GitHub repositories. Preliminary checks show that all these samples use Lua as part of the execution chain. Common forms include a .cmd or .bat launcher that invokes a local LuaJIT or a renamed interpreter, followed by executing a Lua script in the same directory. The bait themes in the corresponding repositories cover multiple categories, including AI models and tools, MCP services, development scripts, and wallet projects.

It should be noted that, currently, we have not performed full code reconstruction and attack-chain analysis for each of these 29 samples individually. Therefore, the existing evidence can only confirm that they all exhibit malicious behavior and share a Lua technology stack; it does not allow us to conclude that all samples use exactly the same obfuscation method, execution flow, C2 infrastructure, or final payload.

Summary

A Qwen-impersonation GitHub repository points the download entry to a 487 KB ZIP. The package contains no model weights—only a LuaJIT interpreter and an obfuscated script. The saved C2 responses are associated with the inner credential-stealing payload, and we classify it as StealC.

Risk involves browser sessions, email and operations credentials, Steam tokens, and wallet-related materials—provided that the corresponding materials are successfully obtained. Between the two collections, the distribution repository, file names, outer PE, and AES keys have changed. The inner payload differs only by one character in the build number. The 29 similar ZIPs across 23 repositories show that this deployment skeleton has been batch reused; the complete subsequent chains for each variant still need to be confirmed sample by sample.

Recommendation

1. Isolate and collect evidence: when the host hits the ZIPs, script hashes, C2, or download URLs listed in this article, first save the download source, process tree, network connection logs, and dropped files, then perform cleanup.

2. Check host modifications: if you find execution records for the launcher, or records of LuaJIT loading large obfuscated text (including renamed interpreters), you should check Scheduled Tasks, the Run key, and the StartupApproved items, and verify whether Defender’s exclusion list includes the system drive or files with .exe/.dll extensions.

3. Handle credentials: when confirming a sample execution or finding related dropped payloads, reset browser sessions and saved passwords, email accounts, Steam tokens, and WinSCP session credentials. If wallet private keys or mnemonic words are stored on the host, first migrate the assets to a new address, then handle the host itself.

4. Add combination detection: add the sequence “small launcher → local LuaJIT or renamed interpreter → a large single-line text in the same directory → initiate an HTTP request or write to executable memory” into monitoring rules. All services used in this chain are legitimate. Judgement should be based on combinations of behavior and the specific malicious URLs listed in this article; do not indiscriminately block GitHub Raw or public Polygon RPC.

IOC

IP

217[.]119[.]129[.]122

194[.]48[.]248[.]94

217[.]119[.]129[.]97

89[.]169[.]12[.]194

URL

http[:]//217[.]119[.]129[.]122/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=

http[:]//217[.]119[.]129[.]97/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=

https[:]//raw[.]githubusercontent[.]com/unburdened-jackinthebox365/qwen38-uncensored/main/assets/uncensored_qwen_v2[.]6[.]zip

https[:]//github[.]com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/tool[.]log

https[:]//github[.]com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/verb[.]log

https[:]//github[.]com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/vs[.]log

https[:]//github[.]com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/ssl[.]log

Malicious dependency

https[:]//github[.]com/unburdened-jackinthebox365/qwen38-uncensored

https[:]//github[.]com/Minaadelfouad64/tools

https[:]//github[.]com/fuhuhlatoogan/mtp

https[:]//github[.]com/0ogata0/qwen-php-client

https[:]//github[.]com/115th-discomfited211/Awesome-Harness-Engineering

https[:]//github[.]com/123affano1/claudetrack

https[:]//github[.]com/1sustgmboab/nexonco-mcp

https[:]//github[.]com/2josEx/claude-brain

https[:]//github[.]com/428alexander9/claude-skills-marketplace

https[:]//github[.]com/45d5r/databricks-mcp-server

https[:]//github[.]com/7ossamfarid/mcp-mindmesh

https[:]//github[.]com/Bean5789/bbd2api

https[:]//github[.]com/CleverPortal/CollabNote-Fullstack-App

https[:]//github[.]com/Juanvil9941/AI-Invoice-System

https[:]//github[.]com/Kalainilavann/takeout_downloader_script

https[:]//github[.]com/Prestonflatfooted659/Void-Tools-v2.0

https[:]//github[.]com/Walloperlioncub193/Canva-Resource

https[:]//github[.]com/archontelemetered604/clash-for-windows

https[:]//github[.]com/fantastic-interpolation620/ctx-wire

https[:]//github[.]com/mikenob39wang/phone-number-location-tracking-tool

https[:]//github[.]com/recognisable-riddance165/Portable-Offline-LLM

https[:]//github[.]com/sociologisttentcaterpillarmoth213/100xdev-ci-cd

https[:]//github[.]com/soldat-panther/qq-farm-cdp-auto

https[:]//github[.]com/thaddeusprobabilistic193/Xault-Wallet

https[:]//github[.]com/twelfth-puerperium297/tokenoptim

https[:]//github[.]com/wasila7220/multi-model-router

Malicious file

filename: uncensored_qwen_v2.6.zip
MD5: bf21a07ad5743d3ae9f55ff526428a0a
SHA1: 8e3391c17c3f4fb6f42594de7425df96dbbbc01e
SHA256: 36d0bac5743ed9c6858258f28f2c2f9161dc06c4d5af73eb7eda1211ea610758

filename: Application.cmd
MD5: 17d94f34b9d15449b03bc099a637782b
SHA1: eb474f898256e8e7baaf0d63b306d1169e637c73
SHA256: 7c4f3e09c6428d0a0d7d85615695f5fedb35bb4e7180d31e1f8a1bacf22e5639

filename: cert.txt
MD5: ccfc0f145861f23c6850c691c4be54b9
SHA1: b88ac887493f31cf9f160ddbc6bc3a2aa298a0ca
SHA256: a75561a3224d9f836058a6d0204ed2e6c1f638275a59495935cd2a5e46fd28ca

filename: tool.log,vs.log
MD5: 8063ba8ec896b52e5e6d435cc60e82f7
SHA1: f445bd4c5b65b7e013ec518f34f4cd64676201d2
SHA256: 7ebbb61733d8aefcf9401f00e8ff7e593c9f0edecb6609675aebd3eb78a5ae2d

filename: verb.log
MD5: 650a8ee5d091275040ae4dd02dcdd806
SHA1: 343d819ceb63c742912723c42fd158b82d0a90be
SHA256: 699af883d862d8949a494f69e2d300142ce506a0ac6c7a239193c111dfed241e

filename: inner-payload.aes256-ecb-decrypted.bin
MD5: 01e433263a7fd50e812195ff4c11cc90
SHA1: ea53a41c53181374cade8d69882bb1390f0c2562
SHA256: ec981c45d494896037583c746543490176c9ce9a1482e62c4e8ab189c2650b1c

filename: ssl.log
MD5: 9d11bce9c213924b53bcb986f07945c6
SHA1: 2abf1436933dc6b63a016661d5d16f1eda303b59
SHA256: 7b0d919bd510cbcc587cca4b74aad1e086fb1fc34882a39946e6db7d4361a746

filename: inner-payload.build1.bin
MD5: 370f95bf40a9c9fe852b2e4bdd95689f
SHA1: 219a0e7c3907bb65ef7db7428400745570d4e105
SHA256: 5d63f3dc9371d4496ca0e728a794151978e94b69ae4b3c705cea4e67cc6cf208

filename: client_qwen_php_v2.4.zip
SHA256: 073c6192ab4c2d5d25fc13acab4c216c96f9d5926064c534e3803bb31d527b28

filename: Engineering_Harness_Awesome_1.9.zip
SHA256: 0870fe8a4d9e64e335047e16ed1d6b0805beab9686495a1e8c247cf2e1a8e930

filename: Software_v1.6.zip
SHA256: 71b37b48f80106fc864be7e82481cd1a2f7decfeaf1dce45abb924d7f32da933

filename: nexonco-mcp-v3.0-alpha.1.zip
SHA256: a866d90d6f1dd82ddcd2cbef4f5550c77bb58dbda87c02eedb441a117b7d89b9

filename: claude-brain-v1.4-alpha.3.zip
SHA256: a271231ebf6174b11aeb3337c238abc0eac44b48b5fa8d2b168883601d8cc3a5

filename: brain_claude_2.2-alpha.1.zip
SHA256: ca4babb4444af81cf93b34436de7a4a3c8e1a93f6233bcc8753ddd868b4c9eaa

filename: claude-skills-marketplace_v3.4.zip
SHA256: 438033226b1bd1e26db8ab71a777e74cc90b5c31310139269fe8e52308f6c938

filename: skills-marketplace-claude-2.9.zip
SHA256: f07a4eadd43513f56ae4fdf6f6dfc966de17f06093c75c1dec0dd426668779f9

filename: server_databricks_mcp_1.6.zip
SHA256: 66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad

filename: mindmesh_mcp_1.0-alpha.5.zip
SHA256: e8da8c82ccb1c6fd68e7c03187485d6ebbd07a4946a7f07cac54fef65b00d2bf

filename: bbd-api-3.1.zip
SHA256: 3524dc4a232c76067f8b2df9adf34ae1106dcc1528e5467c1abc285fc51d1e82

filename: Note-Collab-App-Fullstack-v3.6-alpha.5.zip
SHA256: 6f823d15658b07d6d90f292848fcdd30fe840f83d653cc34966e2fd61d9c3117

filename: Invoice_A_System_3.9.zip
SHA256: 8332d91619563e46e248f427cf489f8bd61a83124eb4c95749ce284b443a2803

filename: downloader-script-takeout-v1.1.zip
SHA256: 8412f2d2b47181f272b0c0e02fe619331e0c2c8d3b90f32e8ce08ac98aaec3f6

filename: downloader_takeout_script_v3.8.zip
SHA256: b781102c6ff857fb45089a6b3d30c5ebb7699ec7e8771bfa0039bef28de782bd

filename: takeout-downloader-script-galvanocauterization.zip
SHA256: 13dc7623c66d1fed51ae94b0d96e8ed45c93d893afabf9aceb4ef0a8da0243ee

filename: Void-v-Tools-v1.7.zip
SHA256: 841d0c25137f35b60d940705ab7b5dc3e9936f37e0561934e72c5dafe93466d8

filename: Resource-Canva-2.2.zip
SHA256: ac6a24d02209df94f56f67e7f3f19dc997f7a2625b91add1dd10cdec0a06d392

filename: for-clash-windows-3.2.zip
SHA256: 036062622f3a1fa2718afc91f8fe4edc693b757365dfc2c0958b70fe8c84c20d

filename: wire-ctx-2.6-alpha.1.zip
SHA256: db0640eb414a89bb62953f0aa7603557f3b8de515e7c3696156abc10f835ecef

filename: location-tracking-tool-phone-number-v3.3.zip
SHA256: 3fc5816afde3e58bf9fcaa1b3873f2d4bc8629ee7a8341a4a4979d2729cad5e6

filename: location_number_tracking_tool_phone_v2.5.zip
SHA256: 398ea394f9a4242ebe9fd67a5ca62445fc4a34b1731d4f99b8eea5e65a98ddcb

filename: tracking-tool-location-number-phone-3.2.zip
SHA256: b6e81d95c0c336e8b8bde3889f4df4ee17639f6ff055c631de19cab3c7efb63b

filename: Offline_LLM_Portable_v2.1-alpha.1.zip
SHA256: 1313b6cfb1ea43367fdd845f64526b4972a3a345bb8b13cef7ebb678d59b5f55

filename: ci_cd_xdev_v2.3-alpha.3.zip
SHA256: ed1ae6799ecb1fc7c5239c4ab95b3b9de9462f21219f144a25b91b6fd430a2c2

filename: farm-cdp-qq-auto-1.1.zip
SHA256: 6145aeacba6533e10dcea287d0fff64c48a790c58ae266ed18ea5d13c36d27ca

filename: v3.9.zip
SHA256: a0dd4924bec9bc077b1f98ddcb45b4e07b01e63ad703c2507d822b5b5130a077

filename: Software-Lithodes.zip
SHA256: 40c2b7b8dcfa6bfe0a199af9ea4baa00a4b8ecd73afa326702cdc4197d64bdef

filename: model-multi-router-v3.5-beta.1.zip
SHA256: 152929ae778e6ed9f358ca8590d2155e1a04137b109a5442891e1ba3fe1a7f82

About MistEye

MistEye is a Web3 threat intelligence and dynamic security monitoring platform developed independently by SlowMist. Through APIs, it provides malicious activity detection for the open-source package ecosystem and supply-chain risk warning capabilities.

All malicious packages and IOCs involved in this operation have been ingested into the MistEye threat detection engine. Developers can use the API to automatically detect project dependencies, quickly determine whether they match known malicious packages, and obtain remediation recommendations.

📖 API documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan
A lightweight CLI tool that scans project dependencies and known malicious packages in globally installed packages with a single command. Supports npm / PyPI / Cargo / Go / RubyGems ecosystems

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills
AI coding assistant security skills pack. Automatically triggers MistEye security detection before dependency installation and URL access

🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard
A DNS security protection tool that detects malicious domains and risky access, and identifies network threats such as phishing and C2.

This article was written by the SlowMist Threat Intelligence team together with the MistEye threat intelligence system and SlowMist Agent AI-driven analysis. If you have any questions, please feel free to contact and provide feedback.

Reference

[1]https://x.com/OpcodeIntel/status/2091578565628502324

[2]https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/

[3]https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html