GCVE-110-OSM-2026-733

Credential stealing malware that exfiltrates sensitive files (.env, config.toml, id.json, and any files with extensions) containing API keys, database credentials, and authentication tokens to remote C2 server. Evolved through 8 versions over 2 weeks with increasing stealth. Uses base64-encoded strings and obfuscated function names to evade detection. Scans current directory for credential files, collects username and local IP via UDP socket trick (connecting to 8.8.8.8:80 without sending packets), then exfiltrates via HTTPS POST to rust-docs-build.vercel.app with 100ms delays between requests. Latest version (0.1.7) targets *.* wildcard pattern matching almost any file.