GCVE-110-OSM-2026-1543

Malicious PHP/Packagist package part of North Korea's Contagious Interview campaign. Impersonates the golang.org brand in the PHP ecosystem. Contains malicious code in func/log.php that downloads and executes staged RAT payload for credential theft and data exfiltration. === PAYLOAD: Staged Loader === Malicious payload found in: func/log.php Behavior: Downloads and executes staged RAT payload Impersonates golang.org in PHP ecosystem C2 domains: logkit.onrender.com, logkit-tau.vercel.app Threat actor GitHub: github.com/golangorg