GCVE-110-OSM-2026-675

This is a malicious git repository used by fake recruiters on LinkedIn to target developers an steal their crypto currency. - The script collects system information including hostname, platform, home directory, and temporary directory using os.hostname(), os.platform(), os.homedir(), and os.tmpdir(). - It checks for specific directories and files related to web browsers like Chrome, Brave, and Opera, then attempts to read these locations for sensitive information such as user profiles and extension data. - It attempts to steal macOS keychains and Solana wallet keys. - The script uploads collected data to a remote server **(95.164.17.24)** hosted in the Netherlands. It uses the request module to send POST requests with the stolen data. - It includes mechanisms to run multiple times, ensuring persistence and continued data theft. The script also downloads and executes additional payloads from the remote server—potentially more malicious scripts or executables. - The script scans for browser extensions and profiles to gather user data and credentials. - It adapts its behavior based on the operating system: Windows (w), Linux (l), or macOS (d). - The additional Python payloads are easily accessible by following the URLs. These install a RAT, perform keylogging, and establish communication with a command-and-control server. - A final Python payload attempts to steal credentials and credit card data from browser files.