GCVE-110-OSM-2026-159

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published May 26, 2026

Malicious package detected. Behaviors: data exfiltration, obfuscated code. Entrypoint: XcT_x_AyOuB/__init__.py (module-import: 46) Exfil: https://clientbp.ggpolarbear.com/GetLoginData (custom-c2, recovery: plaintext in XcT_x_AyOuB/core.py) Payload: XcT_x_AyOuB/core.py Key findings: - Decoded Hex String Content in XcT_x_AyOuB/core.py - Brand New Package - Rapid Version Publishing IOCs: - urls: http://0.0.0.0:, https://clientbp.ggpolarbear.com/GetLoginData, https://client.ind.freefiremobile.com/GetLoginData, https://client.us.freefiremobile.com/GetLoginData, https://100067.connect.garena.com/oauth/guest/token/grant - domains: loginbp.ggpolarbear.com, clientbp.ggpolarbear.com, client.ind.freefiremobile.com, client.us.freefiremobile.com, 100067.connect.garena.com - sha256Hashes: 1C39C3B1CEECC3FBAB85E5595A22F82FE7AED6A76C8F5E7DE92F7E851A536783, ECE31C92284F85994D3CC76E6CFE329C029B6C13DAA1D952878F92C1A4F138DF, 7B84F03C20991E6AD8B46DC64BA136290A8E434BD3C5E8CBEB533569AFF6AA77, 6C605BFF9A13E9E0786DD107DB62C4B66D32C86A1FA818751B93479996472B35, 066AF8B5479D281C9A1FDA3CCEE7FA6F2C30AD1EA352FE2B66C1D601F48A46CF (+45 more) - ips: 176.28.139.185 - payloadFileHash: 470e89ed52cb57e79bf9c02d36ce9c9b8af4783b8f45a843fdcd3ea5b8022228 Decoded/deobfuscated IOCs: - ips: 176.28.139.185

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	chat-xdk	all (affected), * (affected), all (affected), all (affected)	—
unknown	demozecosso	all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), * (affected)	—
unknown	internal-linking	all (affected)	—
unknown	xct-x-ayoub	all (affected)	—
unknown	prateek-yadav23	all (affected), all (affected), * (affected), all (affected)	—