GCVE-110-OSM-2026-11260

This is an infostealer targeting a victim machine: the entrypoint `decoris/main.py` reads Roblox cookie data from `AppData\Local\Roblox\LocalStorage\robloxcookies.dat`, decrypts it with `CryptUnprotectData`, and posts the result to a Discord webhook and a Google Script endpoint. It also harvests Discord tokens from `Local Storage\leveldb`, kills `Discord.exe` with `os.system("taskkill /f /im Discord.exe")`, and sends token/user data to `https://discordapp.com/api/v6/users/@me` and the same webhook. The attacker model is straightforward credential theft and exfiltration via a hardcoded Discord webhook (`discord.com/api/webhooks/...`) with no plausible legitimate package behavior explaining these actions. The MAL-2026-14554 advisory is corroborated by the actual code rather than serving as the sole basis for judgment. ENTRY decoris/main.py (console-script: spaysdata-run=decoris.main:main_entry) LOOT - Discord Token Theft in decoris/main.py: "discord\\Local Storage" DESTINATION - 3 exfil (discord-webhook, custom-c2) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in decoris/main.py: "discord.com/api/webhooks/1542244779985735730/wMFwSDiezSzn5KtqInetmtFj9TFdVNWTLgt..." - Data Encoding for Exfiltration in decoris/main.py: "base64.b64encode(" - Network Request in decoris/main.py: "requests.post(" ADDITIONAL FINDINGS - Shell Command Execution in decoris/main.py: "os.system(" PAYLOAD FILES decoris/main.py