GCVE-110-OSM-2026-11679

The package exfiltrates Roblox cookies from the victim machine. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-spaysrbdata Reasons (based on the campaign): - infostealer Judge assessment: This is a credential-stealing infostealer aimed at Windows users, with a clear attacker model of harvesting Discord tokens and Roblox cookies and sending them to attacker-controlled endpoints. The entrypoint in `minecraftmodes/main.py` reads `discord\Local Storage`, kills `Discord.exe`, extracts tokens with `get_tokens()`, and posts them via `requests.post()` to the Discord webhook `https://discord.com/api/webhooks/...` and a Google Script C2. It also copies `robloxcookies.dat`, decrypts `CookiesData`, and exfiltrates the decrypted contents, which matches the MAL-2026-15937 advisory and is directly visible in the code. The use of `os.system("taskkill /f /im Discord.exe")`, `win32crypt.CryptUnprotectData`, and `base64.b64encode()` in the same file reinforces deliberate theft and transmission rather than legitimate functionality. ENTRY minecraftmodes/main.py (console-script: minecraftmodes-run=minecraftmodes.main:main_entry) LOOT - Discord Token Theft in minecraftmodes/main.py: "discord\\Local Storage" DESTINATION - 3 exfil (discord-webhook, custom-c2) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in minecraftmodes/main.py: "discord.com/api/webhooks/1542244779985735730/wMFwSDiezSzn5KtqInetmtFj9TFdVNWTLgt..." - Data Encoding for Exfiltration in minecraftmodes/main.py: "base64.b64encode(" - Network Request in minecraftmodes/main.py: "requests.post(" ADDITIONAL FINDINGS - Shell Command Execution in minecraftmodes/main.py: "os.system(" PAYLOAD FILES minecraftmodes/main.py