GCVE-110-OSM-2026-9597

cognikit presents a classic infostealer architecture: constants.py hardcodes Windows browser data paths (AppData\Local\Google, AppData\Local\Microsoft) targeting Chrome and Edge credential stores; hardware.py fingerprints the victim machine via platform.system(), platform.machine(), and ipify.org public IP lookup; fileops.py uploads collected files to a hardcoded C2 using token-authenticated multipart POST requests. The attacker model is a credential-harvesting dropper masquerading as an 'AI toolkit helper' — a common lure for developer-targeted supply-chain attacks. The publisher taan_dev has zero prior packages, no source repository, and no homepage, consistent with a throwaway account created solely for this campaign. The combination of browser path enumeration, system fingerprinting, and authenticated file exfil to a raw IP C2 leaves little room for a benign interpretation. LOOT - Browser Data Theft in cognikit/constants.py: "AppData\Local\Google" EXFIL - Python File Upload to Remote in cognikit/fileops.py: "requests.post(url, params={"token": token}, headers=headers, files=" - Data Encoding for Exfiltration in cognikit/message.py: "json.dumps(data).encode" - Suspicious Domain in cognikit/config.py - Network Request in cognikit/fileops.py: "requests.get(" - Network Request in cognikit/hardware.py: "urllib.request.urlopen(" - System Information Collection in cognikit/hardware.py: "platform.system()" ADDITIONAL FINDINGS - Shell Command Execution in cognikit/hardware.py: "subprocess.run(" PAYLOAD FILES cognikit/hardware.py (+ cognikit/fileops.py, cognikit/constants.py)