MAL-2026-11413

-= Per source details. Do not edit below this line.=-

Source: kam193 (20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6)

Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-reguestsc

Reasons (based on the campaign):

• typosquatting

• Downloads and executes a remote executable.

• malware

• clones-real-package

• spyware-like

• infostealer