GCVE-110-OSM-2026-14573

The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-extera-plugin-runtime Reasons (based on the campaign): - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine. - files-exfiltration - target:telegram ENTRY extera_plugin_runtime/__init__.py (module-import: 9) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in extera_plugin_runtime/http.py: "urllib.request.Request( url, data=" - Data Encoding for Exfiltration in extera_plugin_runtime/http.py: "json.dumps(json_body).encode" - Python File Upload to Remote in extera_plugin_runtime/runtime.py: "urllib.request.Request( self.server + path, data=" - Data Encoding for Exfiltration in extera_plugin_runtime/runtime.py: "json.dumps(body).encode" - Network Request in extera_plugin_runtime/http.py: "urllib.request.Request(" - Python Background Thread Execution in extera_plugin_runtime/runtime.py: "threading.Thread(target=self._run, daemon=True) self._thread.start() return self..." - Network Request in extera_plugin_runtime/runtime.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Suspicious TLD Domain in extera_plugin_runtime/runtime.py: "https://extera-plugins-updater.top" PAYLOAD FILES extera_plugin_runtime/runtime.py (+ extera_plugin_runtime/http.py)