GCVE-110-OSM-2026-12860

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-donutautosellsrc Reasons (based on the campaign): - infostealer - Downloads and executes a remote executable. - obfuscation - malware - native-extension - steganography - c2-in-blockchain - The package contains code to detect if it is running in a sandbox environment. ENTRY donutpromotion/cli.py (console-script: donutpromotion=donutpromotion.cli:main) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in donutpromotion/security.py: "base64.b64encode(" - Network Request in donutpromotion/telemetry.py: "urllib.request.Request(" - Suspicious Domain in donutpromotion/telemetry.py: "https://thisisafalsepositive.st" OBFUSCATION - Base64 Encoded Payload in donutpromotion/_payload.py: "'ASuL0lynDiHqxeqhhJ+91Jo32ErPYBjZT/aTUD2hN1Yqp4K7fxIFkUCDZyj0koJoQDBwRq9MhJd1+Nk..." PAYLOAD FILES donutpromotion/security.py (+ donutpromotion/telemetry.py)