MAL-2026-11415

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214)

Package connects to a hardcoded C2 socket server (SOCKET_SERVER_HOST/SOCKET_SERVER_PORT from cognikit.config) and runs a typed-message session loop that gives the remote peer full control of the installer's host. handlers.handle_command base64-decodes attacker-supplied strings and passes them to subprocess.run(..., shell=True) via command.execute_command, yielding arbitrary shell RCE. The session dispatch also implements download (write attacker files to disk), upload/archive (exfiltrate arbitrary files or zipped directories to the C2), install/grabext (install or steal browser extensions), and keylog (upload keylogger output). launcher.run_helper spawns a background daemon that keystrokes and monitors the clipboard, swapping crypto wallet addresses with attacker-supplied replacements fetched from {DJANGO_API_URL}/address and decoded via base64 + XOR with the static key 'w3x'; the keylog file is later uploaded via upload_file_to_public_api(kl.log_path, machine_id, 'key'). The obfuscated wallet-replacement list and the clipper/keylogger integration confirm hostile intent.

Source: kam193 (21e18e6e4016bf07f11edb272a08fb26268b2fbfe0b42a4ba502df368ce05b01)

In this campaign, some packages (e.g. cognikit, aiassistcore) are pulled as dependencies and contain the C2 configuration and the malicious functionality, while others (like aichannel) provide fake functionality and silently execute malicious actions from dependencies. The malicious functionality is oriented to replace the copied cryptocurrency wallet addresses with these controlled by the attacker and downloaded from the C2 server, exfiltrating browser data, establishing a remote control over the device, placing malicious extensions in browsers.

IoCs are consistent with those previously attributed to North Korea's "Contagious Interview" campaign. The known...