GCVE-110-OSM-2026-4172

Exfiltrates system-wide screenshots and active window context to api.groq.com using attacker-bundled Groq API keys on every hotkey trigger, transmitting exam questions, coding challenges, and any screen content as base64-encoded PNG via the Groq LLM API. Installs layered Windows persistence via scheduled task 'MicrosoftEdgeWebView2Update' (1-minute interval) and a watchdog that restarts the daemon within 1500ms — source code explicitly references evading TestPad's 30-second scan window. Disguises the Electron binary as msedgewebview2.exe by rewriting PE version headers, masquerades the process as 'Windows Audio Device Graph Isolation', and applies content protection to hide the overlay from screen recording tools. **Trigger**: User invokes CLI ('rojgar start'). No install hook — execution requires user to run the package. **Setup**: dist/cli/index.js:disguiseElectron copies Electron to msedgewebview2.exe and rewrites PE headers (FileDescription, ProductName, OriginalFilename) via rcedit to impersonate Microsoft Edge WebView2 Runtime. **Persistence**: dist/cli/index.js:installResurrector registers Windows scheduled task 'MicrosoftEdgeWebView2Update' via schtasks /create /sc MINUTE /mo 1 running resurrect.js from %APPDATA%/rojgar/. cli/guard.cjs watchdog spawns Electron daemon and restarts it within 1500ms on death (source comment: 'fast enough to beat TestPad's 30s scan'). **Stealth**: Process title set to 'Windows Audio Device Graph Isolation'; AppUserModelId 'Microsoft.Windows.SystemTray'; skipTaskbar: true; win.setContentProtection(true) re-applied every 3s. **Collection**: desktop/dist/daemon.cjs registers uiohook-napi global hotkey listeners. On trigger: screenshot-desktop captures full-screen PNG; active-win collects foreground app name, window title, URL. **Key provisioning**: dist/shared/index.cjs decrypts Groq API key from shared/keys.json pool (AES-256-GCM, static secret 'pageai-pool-v2') using machine-ID-derived slot assignment. **Exfiltration**: Groq SDK client sends base64 screenshot as image_url content part and window context as text to https://api.groq.com. TLS certificate validation globally disabled via NODE_TLS_REJECT_UNAUTHORIZED='0'.