GCVE-110-OSM-2026-10574

During import, package exfiltrates all files from "/sdcard/" Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-socks5901 Reasons (based on the campaign): - files-exfiltration - uses-telegram-bot - target:android Judge assessment: This package is an Android-targeted infostealer that runs on import via `socks5901/__init__.py` and immediately calls `run_full_scan()`, so the attacker model is a malicious package install/import dropping a data thief into the environment. The implementation in `socks5901/core.py` exfiltrates system context and then iterates through `/sdcard/`, uploading every file over Telegram using the plaintext bot token `8824962750:AAFh4zwNCPgBOYTrQGWN3ZGKBv4opt-lGvo` and chat `8570102679`. The hardcoded `ipapi.co/json/` lookup, `socket.gethostname()` fingerprinting, and `requests.post(..., files=...)` document upload are consistent with staged collection and exfiltration, not legitimate library behavior. The OSV advisory `MAL-2026-14100` is corroborated by the actual code and recovered IOCs, so this should be treated as confirmed malicious. ENTRY socks5901/__init__.py (module-import: 3) DESTINATION - 5 exfil (telegram-bot, custom-c2) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in socks5901/core.py: "requests.post(url, data=data, files=" - Network Request in socks5901/core.py: "requests.post(" - System Information Collection in socks5901/core.py: "socket.gethostname()" PAYLOAD FILES socks5901/core.py TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @socks5901bot (id 8824962750) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @NgDuc012