donutautosellsrc@0.3.9

Summary

During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in Polygon blockchain. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-donutautosellsrc Reasons (based on the campaign): - Downloads and executes a remote executable. - steganography - malware - native-extension - infostealer - obfuscation - c2-in-blockchain

Source: kam193 (2ac1203ac68b4bb062c4dd38f59fd8bd13fef695c5b1c8059160c6a5205717b1)