DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Credit Card Theft – Card Data Extraction Process Hacker memory analysis reveals that DarkTortilla RAT targets credit card information, including card numbers, expiration dates, and card types. Key Strings Observed: cardnumberencrypted – Encrypted card numbers. expirationmonth – Expiration...

telegram-c2

Telegram C2 Command and control a server via telegram bots. Installation Tutorial Video Create a telegram bot Edit main.py, set BOTAPIKEY to the bot's api key and telegramuserid to your telegram id Install the following dependencies pip install -r requirements.txt Compile to standalone binary for...

BrainDamage

BrainDamage A python based remote administration tool which uses Telegram as C&C server. /\ /.\ ,.-'/ ",'-., -^ /-^: | \ | \ | | | | | | | | Coded by: Mehul Jain -- For windows only | | | | | | | | | / / | | | | | '/ / | | | | / | | || || | | | /\ \ || |,||,|| ||/ -- Persistance -- USB...

Malicious code in @inetafrica/open-claudia (npm)

Source: amazon-inspector 09b3881ec598069649e57612f04359886ef22331899541885248ea6a0a41bce2 Multiple files in this package contain a Telegram-bot-based command-and-control and exfiltration framework wired to install/runtime-reachable code paths. setup.js line 57, 73 and health.js line 90 embed...

Malicious code in trustwallet (PyPI)

Source: kam193 ffef6e3541d5ab62ee32f0d44e9da05c6e495c15a4c9a9d9a4866e40ae502604 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in requests-testik111 (PyPI)

Source: kam193 72561775d8d7a7c1e47c83f2a7e13ed9eeb776d05ca6924cfcceaca7cad0cfef Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in pywin-simple-gui (PyPI)

Source: kam193 43b40c0dbbbc187822a28a401194873adc73d13e531f2789c4227374f7ec9e26 The package pretends to be a development helper but, in fact, downloads a remote executable. Dynamic analysis reveals actions like disabling Windows Defender and interest in cryptocurrencies as well as using Telegram ...

Malicious code in metamask-api (PyPI)

Source: kam193 d741c998a924aa720c19f13cbb622ebb5862abde8765dac7f8bb2cf1b219c3dc Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in logghelper (PyPI)

Source: kam193 2a5f0848002e1727d885bdf20c39e4949fd9609a4df5164a8c42ccc870aa6736 Code attempts to download and run malware, as well as keeps ability to execute files sent via Telegram C2 channel --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in kryptex-os (PyPI)

Source: kam193 034201cad27492b279f5c274a5091b2e617da50f27125c7774db069256b3486e Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in hiveos-setting (PyPI)

Source: kam193 36035629c3bde2cc0e1f5c5531cac6c4ece9ff587cc3c85a5e39bcafbded06d9 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in hiveos-settings (PyPI)

Source: kam193 cc412fc6f4c4059bbea28f3aa4ff430b5cc0405b6117995d8b401be1ed514932 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in hive-os-settings (PyPI)

Source: kam193 27052e523741d1d8f29aaadcd3735affbdeaa919d6fad2d0ff01ce878d6e5637 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in gemini-ai-api (PyPI)

Source: kam193 db2be37ea455b54b825242a3f66310fdf3f70e50b1dc1a234fa3ebb534afa857 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in gate-apis (PyPI)

Source: kam193 720c6a00b12826104b04d6b90dc651d5c669532946a36d8c36e3dff5fd5edb6d Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in easyreg (PyPI)

Source: kam193 2897582bf6c0c29d4fc679ee338263019a8a5d5bcb66b5ae2c59454d6c967d6a The package pretends to be a development helper but, in fact, downloads a remote executable. Dynamic analysis reveals actions like disabling Windows Defender and interest in cryptocurrencies as well as using Telegram ...

Malicious code in cpu-optimizers (PyPI)

Source: kam193 f82b75da107c50f4d2f3cf5587e7db58a0dc91b77f8511226ff9219623dc145a Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in copytrading (PyPI)

Source: kam193 00e18dbfb3978939790912c09da21fd43b670c4017c160002bb5fc534164e577 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

Malicious code in claude-lite (PyPI)

Source: kam193 3a73f0745200bef9d517a2ac5e3e69189347e0b730a0187e71c3c201accd5833 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

MSC-2026-6129

Malicious npm/PyPI packages impersonating Solana web3.js and CMS tooling; install-time credential + crypto-wallet stealer Solana keypairs, .env, SSH, cloud/SCM tokens with Telegram-C2 backdoor, fund-draining and RPC-tampering. Entire package malicious...