GCVE-110-OSM-2026-4320

[osmalyze-auto] APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, install-time execution. [osmalyze-auto] Entrypoint: phantom.js (install-hook: node phantom.js) Exfil: https://myvault.vault.azure.net/secrets/mysecret/version123 (custom-c2, recovery: plaintext in phantom.js) Payload: phantom.js Secondary files: postinstall.js Key findings: - Stealth Background Process Spawning in phantom.js: "spawn(process.execPath, process.argv.slice(1), { detached: true, stdio: ..." - Environment Variable Exfiltration in phantom.js: "process.env; // Request OIDC token with npm audience let response = awa..." - Sensitive File Access in phantom.js: ""~/.ssh/authorized_keys"" - Cryptocurrency Wallet Theft in phantom.js: ""~/.bitcoin" - Discord Token Theft in phantom.js: "discord/Local Storage" IOCs: - urls: https://myvault.vault.azure.net/secrets/mysecret/version123, https://myvault.vault.azure.net, https://87e0bbc636999b.lhr.life - domains: myvault.vault.azure.net, Drone.io, Screwdriver.cd, kubernetes.io, 87e0bbc636999b.lhr.life (+4 more) - payloadFileHash: d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3