GCVE-110-OSM-2026-12477

Package attempts to lure LLM agents to exfiltrate files to a hardcoded location. Analysis of infrastructure suggests preparing for exfiltrating credentials. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-marketing-mcp Reasons (based on the campaign): - files-exfiltration - llm-threat DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in src/marketing_mcp/server.py: "webhook.site" PAYLOAD FILES src/marketing_mcp/server.py