GCVE-110-OSM-2026-14531

@bellaxchan/eleventech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363431475943819@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342). ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Socket/MessageBuilder.js: ".profile" - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Socket/privacy.js: ".PROFILE" - Startup Persistence in lib/WAUSync/Protocols/USyncBusinessProtocol.js: ".profile" DESTINATION - 2 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/use-sqlite-auth-state.js: "Buffer.from(value?.data || value).toString('base64')" - Network Request in lib/Utils/generics.js: "fetch('https:" - Network Request in lib/Utils/messages-media.js: "request({ hostname: parsedUrl.hostname, port: parsedUrl.port || (parsedUrl.proto..." OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Socket/MessageBuilder.js - Dynamic Base64 Decoding in lib/Socket/MessageBuilder.js: "Buffer.from(media, "base64")" - Dynamic Base64 Decoding in lib/Socket/newsletter.js: "Buffer.from(jid, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/decode-wa-message.js: "Buffer.from(secret, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - Unicode Escape Obfuscation in lib/Socket/MessageBuilder.js: "\u004E\u0049\u0058\u0045\u004C" - String Array Obfuscation in lib/Utils/message-composer.js: "[ 'import', 'export', 'from', 'default', 'as', 'const', 'let', 'var', 'function'..." (+12 more) ADDITIONAL FINDINGS - Silent Process Execution in lib/Socket/MessageBuilder.js: "{ silent: true" - Platform Detection with Data Collection in lib/Socket/message-builder.js: "JSON.stringify({ sections })).toS" - Dynamic Code Execution in lib/Utils/message-composer.js: "exec(line)" - Rapid Version Publishing PAYLOAD FILES lib/Socket/MessageBuilder.js