GCVE-110-OSM-2026-12047

The package hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service. DESTINATION - 8 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Corporate Environment Targeting in .build-env/Lib/site-packages/setuptools/config/_validate_pyproject/fastjsonschema_validations.py: "tmodules): validate_https___setuptools_pypa_io_en_latest" - Corporate Environment Targeting in .build-env/Lib/site-packages/setuptools/discovery.py: "tModuleFinder(ModuleFinder): DEFAULT_EXCLUDE = ( "setup", "conftest", "test" - System Information Collection in .build-env/Lib/site-packages/setuptools/_distutils/compilers/platform/macos.py: "platform.system()" - Network Request in .build-env/Lib/site-packages/setuptools/_vendor/jaraco/context/__init__.py: "urllib.request.urlopen(" - System Information Collection in .build-env/Lib/site-packages/setuptools/_vendor/jaraco/context/__init__.py: "platform.system()" - System Information Collection in .build-env/Lib/site-packages/setuptools/_vendor/packaging/markers.py: "platform.system()" - System Information Collection in .build-env/Lib/site-packages/setuptools/_vendor/packaging/tags.py: "platform.system()" - System Information Collection in .build-env/Lib/site-packages/setuptools/msvc.py: "platform.system()" (+1 more) OBFUSCATION - Decoded Base64 Content in .build-env/Scripts/Activate.ps1 (x45) - Python Lambda Exec Obfuscation Unwrapped in src/aitextkit/text.py - Python Lambda Exec Obfuscation Unwrapped in src/aitextkit/system.py - Base64 Encoded Payload in src/aitextkit/system.py: "'GnryLtw/tb+ac1CbnwnQN2TPObh6yjqXxRs60/6Xy6taD2/Uz+39OIMGUhpFTI1EKtN4+3/RPyVIC/t..." - recovered 13 urls, 6 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Download Execute Delete Pattern in .build-env/Lib/site-packages/setuptools/_distutils/command/install_egg_info.py: "execute(os.unlink" - Invisible Ferret Obfuscation in src/aitextkit/system.py: "zlib').decompress(__import__('base64').b64decode(__[::-1]))" - Invisible Ferret Lambda Exec Pattern in src/aitextkit/system.py: "exec((_)(" - Campaign marker: PolinRider in .build-env/Lib/site-packages/setuptools/msvc.py: "ss_dir" - Shell Command Execution in .build-env/Lib/site-packages/setuptools/_distutils/command/_framework_compat.py: "subprocess.check_output(" - Dynamic Code Execution in .build-env/Lib/site-packages/setuptools/_distutils/compilers/C/base.py: "eval(expected)" (+2 more) PAYLOAD FILES .build-env/Scripts/Activate.ps1