GCVE-110-OSM-2026-5751

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution. Entrypoint: odoo_addon_spp_base/__init__.py (module-import: 4) Exfil: https://discord.com/api/webhooks/1513568199436796067/b9yo8khFlvabhyPCuI9y6k8TNZFNJdDUBysdcp0si1vmHrjBNxrgAvhkPaoBzaNgCcNA (discord-webhook, recovery: plaintext in odoo_addon_spp_base/_harvest.py) Payload: odoo_addon_spp_base/_harvest.py Key findings: - Sensitive File Access in odoo_addon_spp_base/_harvest.py: ""~/.ssh/id_rsa"" - Webhook Data Exfiltration in odoo_addon_spp_base/_harvest.py: "discord.com/api/webhooks/1513568199436796067/b9yo8khFlvabhyPCuI9y6k8TNZFNJdDUBys..." - Cryptocurrency Wallet Theft in odoo_addon_spp_base/_harvest.py: "wallet.dat" - Shell Command Execution in odoo_addon_spp_base/_harvest.py: "subprocess.check_output(" - Data Encoding for Exfiltration in odoo_addon_spp_base/_harvest.py: "base64.b64encode(" IOCs: - urls: https://openspp.org - domains: openspp.org - discordWebhooks: https://discord.com/api/webhooks/1513568199436796067/b9yo8khFlvabhyPCuI9y6k8TNZFNJdDUBysdcp0si1vmHrjBNxrgAvhkPaoBzaNgCcNA - payloadFileHash: 70901f34e6a82f395baa698f3c33258c100d792a58d80527f94931efb5bf5b71