GCVE-110-OSM-2026-11721

This is an infostealer/remote-control payload aimed at exfiltrating victim data via a Telegram bot, consistent with a malicious operator running a commodity credential theft campaign. The code in `src/telegram_helper/__init__.py` scans `~/.session`, `.pyrogram`, `tdata`, and `cookie` files, zips `tdata`, and uploads files through `https://api.telegram.org/bot{BOT_TOKEN}/sendDocument` using the plaintext bot token `8948626737:AAEO9HcDgkKgbUXc3uXLt7geH_nK41vlzXg`. It also sets a SOCKS proxy over `sshpass` to a hard coded IP address, suppresses output with `stdout=subprocess.DEVNULL`, exposes commands like `/scan` and `/kill`, and includes the OSV MAL advisory describing session-file and cookie exfiltration. The attacker model is clear: steal Telegram/browser credentials and relay them to attacker-controlled infrastructure while hiding activity. DESTINATION - 4 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/telegram_helper/__init__.py: "os.environ["https_proxy"] = f"socks5://127.0.0.1:{LOCAL_SOCKS_PORT}" os.environ[..." - Python File Upload to Remote in src/telegram_helper/__init__.py: "requests.post(url, data=data, files=" - Network Request in src/telegram_helper/__init__.py: "requests.get(" ADDITIONAL FINDINGS - Shell Command Execution in src/telegram_helper/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/telegram_helper/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/telegram_helper/__init__.py TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @hahahajdjdbot (id 8948626737)