GCVE-110-OSM-2026-10774

The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistence and starts a malicious process on import. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-httpz-requests Reasons (based on the campaign): - files-exfiltration - rat - persistence - uses-telegram-bot - obfuscation - native-extension Judge assessment: This is consistent with an attacker deploying a Telegram-based RAT/infostealer that runs on import, exfiltrates system data, and tries to persist or auto-install itself. The entrypoint `httpz_requests/__init__.py` eagerly imports `core` on module import, and `core.py` contains explicit Telegram exfiltration to `api.telegram.org/bot{TOKEN_MANAGER_BOT}/sendMessage`, environment-variable handling, system fingerprinting (`socket.gethostname()`, `os.geteuid()`), and shell execution via `subprocess.Popen`/`subprocess.run`. The `download-execute-delete` pattern plus `stdout=subprocess.DEVNULL` strongly indicate stealthy dropper behavior rather than a normal HTTP client. The attacker model here is a credential thief / remote operator using Telegram as C2 to move data off-host and control infected systems. ENTRY httpz_requests/__init__.py (module-import: 94) DESTINATION - 3 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in httpz_requests/core.py: "os.environ.get("HTTPZ_ENDPOINT", "https://httpz-requests." - Python File Upload to Remote in httpz_requests/core.py: "urllib.request.Request( f"https://api.telegram.org/bot{TOKEN_MANAGER_BOT}/sendMe..." - Data Encoding for Exfiltration in httpz_requests/core.py: "json.dumps(obj).encode" - Data Encoding for Exfiltration in httpz_requests/obfuscate.py: "base64.b64encode(" - Network Request in httpz_requests/core.py: "Request( f"http:" - System Information Collection in httpz_requests/core.py: "socket.gethostname()" ADDITIONAL FINDINGS - Download Execute Delete Pattern in httpz_requests/core.py: "executable, temp_script] subprocess.run(cmd, check=False) # Clean up temp file t..." - Shell Command Execution in httpz_requests/core.py: "subprocess.Popen(" - Silent Process Execution in httpz_requests/core.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES httpz_requests/core.py