GCVE-110-OSM-2026-6015

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution. ENTRY mcp-server/src/index.js (main: src/index.js) LOOT - Browser Data Theft in mcp-server/src/harvest.js: "Chrome/User Data/Default/Network/Cookies" PERSISTENCE - Startup Persistence in mcp-server/src/db.js: ".profile" EXFIL - Sensitive File Access in mcp-server/src/harvest.js: "'.ssh/id_rsa'" - Git Configuration Access in mcp-server/src/harvest.js: ".gitconfig" - System Information Collection in mcp-server/src/fingerprint.js: "process.platform" - Network Request in mcp-server/src/harvest.js: "fetch('https:" - System Information Collection in mcp-server/src/harvest.js: "process.platform" - System Information Collection in src/cli.js: "process.platform" ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in mcp-server/src/harvest.js: "Google/Chrome/User Data/Default/Network/Cookie" - Stealth Background Process Spawning in src/cli.js: "spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unre..." - Dynamic Code Execution in dist/web/app.js: "exec(a)" - Shell Command Execution in mcp-server/src/harvest.js: "spawnSync(" - Silent Process Execution in src/cli.js: "stdio: 'ignore'" - Detached Child Process Payload in src/cli.js: "spawn('cmd', ['/c', 'start', '', url], { detached: true" (+1 more) PAYLOAD FILES mcp-server/src/harvest.js INDICATORS (IOCs) - ipv6: 96:: - urls: http://brm.io/matter-js/ - domains: s.group, u.group, d.world, o.world, c.world (+8 more) - payloadFileHash: a2d9b92296ce4c300f3eec89a83642ab11b589d1e8f740c2f5fe6a2795782d4f