GCVE-110-OSM-2026-729

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution. Payload: pycLogger/__init__.py Key findings: - Webhook Data Exfiltration in pycLogger/__init__.py: "discord.com/api/webhooks/1476624189363589211/1KGiqRpGknXBATGwNJ3r0nDctNNX_JWVNBn..." - Discord Token Theft in pycLogger/__init__.py: "dQw4w9WgXcQ" - Chai-Max Browser Data Theft in pycLogger/__init__.py: "Chrome", "User Data", "default", "Login Data" - Python File Upload to Remote in pycLogger/__init__.py: "urllib.request.Request('https://ptb.discord.com/api/webhooks/1476624189363589211..." - IP Lookup Service in pycLogger/__init__.py: "ipify.org" IOCs: - ipv4: 115.0.0.0 - urls: https://discordapp.com/api/v6/users/@me/guilds?{params, https://discordapp.com/api/v6/guilds/{guild[, https://discordapp.com/api/v6/users/@me/billing/subscriptions, https://discordapp.com/api/v6/users/@me/billing/payment-sources - domains: discordapp.com, cdn.discordapp.com - discordWebhooks: https://ptb.discord.com/api/webhooks/1476624189363589211/1KGiqRpGknXBATGwNJ3r0nDctNNX_JWVNBnmcpQDBi0op8pXjxVuGiNBY_yX6Kc5szJb - payloadFileHash: 2a7b1587f187a6898adef8479d5c7060a918a76352cad8ba38046c98fcf400c7