GCVE-110-OSM-2026-6528

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration. ENTRY request_cache_py/__init__.py (module-import: 406) DESTINATION - telegram-bot: api.telegram.org/bot{token}/sendMessage (primary, plaintext) in request_cache_py/__init__.py EXFIL - Git Configuration Access in request_cache_py/__init__.py: ".gitconfig" - Network Request in request_cache_py/__init__.py: "requests.post(" - System Information Collection in request_cache_py/__init__.py: "platform.system()" ADDITIONAL FINDINGS - Download Execute Delete Pattern in request_cache_py/__init__.py: "execute(query) results = cursor.fetchmany(limit) conn.close() temp_db.unlink" - Chai-Max Browser Data Theft in request_cache_py/__init__.py: "Chrome' / 'User Data' / 'Default' / 'Network' / 'Cookies" PAYLOAD FILES request_cache_py/__init__.py INDICATORS (IOCs) - emails: perf-team@pythonutils.org - payloadFileHash: f3a42d1dc1e40084acca2668279d9b1ec9568b5ea2e14fb6da1b8f744e3e61c6