GCVE-110-OSM-2026-8860

This package is a Discord token stealer with a clear attacker model: when a user types 'moooo' as the prompt, cli.py silently launches hii.py, which runs only on Windows (os.name != 'nt' guard), installs pypiwin32 and pycryptodome with suppressed output, then harvests encrypted Discord tokens from browser LevelDB stores across 22 browser profiles, decrypts them using Chrome's DPAPI key, queries the Discord API for user info, guilds, Nitro subscriptions, payment sources (credit cards and PayPal), and exfiltrates all of it to a hardcoded Discord webhook at https://discord.com/api/webhooks/1389881818181926932/S-908aALR9RjCF95UjeQ0DnqxlK_iXu6DdeMyqbzUKkSgmYAzKOioy3tV9oPMCqpXadC. The token regex 'dQw4w9WgXcQ' is a well-known Discord token stealer signature. The package presents as an AI-powered cowsay utility but hides credential theft behind the easter-egg trigger, a classic Trojan delivery mechanism. All IOCs are in plaintext and the exfiltration pipeline is fully visible in the truncated file content. ENTRY src/moooo/cli.py (console-script: cow=moooo.cli:main) LOOT - Discord Token Theft in src/moooo/hii.py: "dQw4w9WgXcQ" DESTINATION - discord-webhook: https://discord.com/api/webhooks/1389881818181926932/S-908aALR9RjCF95UjeQ0DnqxlK_iXu6DdeMyqbzUKkSgmYAzKOioy3tV9oPMCqpXadC (primary, plaintext) in src/moooo/hii.py EXFIL - Webhook Data Exfiltration in src/moooo/hii.py: "discord.com/api/webhooks/1389881818181926932/S-908aALR9RjCF95UjeQ0DnqxlK_iXu6Dde..." - Python File Upload to Remote in src/moooo/hii.py: "urllib.request.Request('https://discord.com/api/webhooks/1389881818181926932/S-9..." - Data Encoding for Exfiltration in src/moooo/hii.py: "json.dumps(embed_user).encode" ADDITIONAL FINDINGS - Shell Command Execution in src/moooo/cli.py: "subprocess.run(" - Silent Process Execution in src/moooo/hii.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/moooo/hii.py INDICATORS (IOCs) - exfil: 1389881818181926932/S-908aALR9RjCF95UjeQ0DnqxlK_iXu6DdeMyqbzUKkSgmYAzKOioy3tV9oPMCqpXadC - payloadFileHash: 66e3c8f2ed4bec15d1702f4afa473df9f4cb1fe50a83c9ed6796069ed12c7a81