GCVE-110-OSM-2026-9143

This package is an openly self-described remote access tool (RAT) with 200+ commands, keylogger, webcam, audio capture, browser credential theft, persistence, and registry access — published under the Chai-Max campaign signature (DPRK/Lazarus) using npoint.io as a C2 relay, consistent with the Contagious Interview attack pattern. The package uses npoint.io JSON bins as an encrypted command relay across multiple files (gcli/__init__.py, gcli/__main__.py, gcli/npoint.py), reads /etc/passwd, establishes cron-based persistence, encodes data in base64 prior to transmission, and executes processes silently with DEVNULL suppression. The publisher (forb403x) maintains companion packages ('nodroid', 'plungerhacker', 'stapler-scanner') with identical offensive tooling framing, indicating a deliberate malicious actor rather than an accidental false positive. The attacker model is a supply-chain RAT that recruits victim machines into a command-and-control infrastructure via npoint.io as a staging relay, exfiltrating credentials, system info, and enabling remote code execution. ENTRY gcli/__init__.py (module-import: 4) PERSISTENCE - Cron Job Persistence in gcli/forensics.py: "/etc/cron" DESTINATION - custom-c2: http://speedtest.tele2.net/1MB.zip (primary, plaintext) in gcli/netutils.py - custom-c2: http://{host (plaintext) in gcli/network_config.py - custom-c2: speedtest.tele2.net (plaintext) in gcli/netutils.py EXFIL - Sensitive File Access in gcli/users.py: ""/etc/passwd"" - Payload Download from Paste Service in gcli/__init__.py: "npoint.io" - Payload Download from Paste Service in gcli/__main__.py: "npoint.io" - Data Encoding for Exfiltration in gcli/audio.py: "base64.b64encode(" - Data Encoding for Exfiltration in gcli/client.py: "base64.b64encode(" - Payload Download from Paste Service in gcli/colors.py: "npoint.io" - Data Encoding for Exfiltration in gcli/crypto.py: "base64.b64encode(" - Data Encoding for Exfiltration in gcli/host.py: "base64.b64encode(" (+22 more) ADDITIONAL FINDINGS - Chai-Max Campaign Indicators in gcli/__init__.py: "npoint.io" - Shell Command Execution in gcli/audio.py: "subprocess.run(" - Platform Detection with Data Collection in gcli/bluetooth.py: "platform.system()}") print("=" * 60) print("\n--- bt_status ---") try: status = ..." - Silent Process Execution in gcli/elevator.py: "stdout=subprocess.DEVNULL" - Shell Command Variable Setup in gcli/host.py: "win32": proc = _sp.Popen( cmd_str, sh" PAYLOAD FILES gcli/utils.py (+ gcli/users.py, gcli/audio.py) INDICATORS (IOCs) - sha256Hashes: 0000000000000000000000000000000000000000000000000000000000000000 - payloadFileHash: 7c9d89f8ddbac121b37cedbb3300288e5927ae3799047465d3909c7590cf6e0b