GCVE-110-OSM-2026-10859

This package is a vibe-coded remote control framework written by a Hindi-speaking threat actor. A stealth-oriented Windows Python application that monitors clipboard changes and exfiltrates copied text to a fixed remote API. It can also capture the primary display on demand and upload the screenshot as a Base64-encoded JPEG. The application uses transparent, borderless overlays, global hotkeys, UI Automation text extraction, a panic-exit function, and simulated human-like typing to covertly obtain and enter remote AI-generated answers. Although it exhibits spyware-like data collection and concealment, static analysis found no persistence mechanism, credential-specific harvesting, arbitrary command execution, or secondary payload delivery. Index.js is imported and installs Python 3.12 silently for Windows. Then index.js installs these python packages as dependencies for the malware: pyperclip, keyboard, requests, PIL, mss, pyautogui, pythoncom, uiautomation, comtypes Finally, the malware runs python pointer.py which is the final payload. it exfils stolen data to a Vercel endpoint and uses the compromised systems oleacc.dll to load Python wrapper definitions. The payload sends HTTPS POST requests to https://iq-sec.vercel.app/api using JSON. Clipboard requests contain the fields `text` and `mode`; screenshot requests contain `image` and `mode`. Clipboard contents longer than five characters are automatically transmitted when they change and the interface is visible. Screenshot collection is hotkey-triggered: the primary monitor is captured, converted to JPEG at quality 50, Base64-encoded, and uploaded. Supported modes are `aptitude`, `dsa`, `fullstack`, `aws`, and `ocr`, with `dsa` as the default. The server response is expected to contain an `answer` field, which is copied to the clipboard and may be typed into the active application using PyAutoGUI or keyboard hooks. A mash mode suppresses printable user keystrokes and substitutes characters from prepared clipboard text. The program also extracts text from selected Windows UI elements through UI Automation and Microsoft Active Accessibility. `oleacc.dll` is loaded from the Windows system installation through `comtypes.client.GetModule` and is not bundled or downloaded. No HTTP GET requests, downloaded payloads, embedded executables, subprocess execution, blockchain activity, file deletion, registry modification, scheduled tasks, services, or other persistence behavior were identified. SHA-256: 7a2337ed0ff407c7b09749dec1dcd000bf4abbe19d16b820bb8f74e5558a3934.