GCVE-110-OSM-2026-10393

This package is a credential-and-session stealer with persistence, not merely a logger. So far I see one hard-coded HTTPS command/exfiltration host, an attacker SSH public key added on Linux, project/environment-file theft, targeted wallet/credential-document collection, and Telegram Desktop session theft on Windows/macOS. I’m checking for any hidden second-stage download or additional encoded network indicators now. It sends HTTPS POST requests to: - /api/validate/system-info — OS, username, and all local IPv4 addresses - /api/validate/project-env — the current project’s .env contents and path - /api/validate/files — stolen environment, JSON, document, and spreadsheet files - /api/validate/tdata/check — checks whether Telegram data was already stolen - /api/validate/tdata/upload — uploads compressed Telegram Desktop session data Relevant code: changelog-utils-logger.payload:316. Data it steals: It recursively searches user directories for: - .env and *.env files - JSON files whose names suggest keys, passwords, credentials, wallets, seed phrases, or recovery data - .txt, .doc, .docx, .xls, and .xlsx files with similar sensitive names - Numeric JSON filenames such as 123.json - Telegram Desktop tdata sessions on Windows and macOS, up to 500 MB Blockchain-related keywords include Bitcoin/BTC, Ethereum/ETH, Solana/SOL, Tron, Polygon/POL, XRP, MetaMask, Phantom, Trezor, Ledger, Electrum, Exodus, and Trust Wallet. These are filename search terms; there are no embedded wallet addresses, RPC endpoints, or direct blockchain transactions. Persistence On Linux, it silently appends an attacker-controlled RSA public key to the current user’s ~/.ssh/authorized_keys, granting future SSH access if the machine is reachable and SSH permits key authentication.