GCVE-VVD-OSM-2026-264

This package targets Discord bot developers using Replit, who would have bot tokens in their settings.json files Payload: BotBooster/__init__.py Key findings: The init.py file reads sensitive data by opening settings.json and extracting the TOKEN field (BotBooster-0.0.3/init.py:11-18). It then exfiltrates the token: Sends the stolen Discord bot token to an attacker-controlled Discord webhook (BotBooster-0.0.3/init.py:19-20). Covers tracks: In version 0.0.1, it even sends a fake success message to the user: "bot is now boosted!" to make them think it worked legitimately IOCs: - discordWebhooks: https://discord.com/api/webhooks/894416668065947688/yeCk4Jefhb0DBc-VTM5Tw6ZtcU_KJfVTnWKEsB8kNzVEONDfcZAQl8vPuxUGeoZW8SCi - payloadFileHash: 49b48d767adf9224da164b16b5fe1697cecf3ac5a2556d6ae282b951d55295d0