MAL-2026-2403

-= Per source details. Do not edit below this line.=-

Source: kam193 (facfcba74011619f5bb2eaf096e41239f81520cb4effff3b45f8b42c84d42060)

During import, the code attempts to exfiltrate to a hardcoded location sensitive data, including private SSH keys, cloud credentials and Windows SAM database.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-polymarkets-sdk

Reasons (based on the campaign):

• exfiltration-credentials

• files-exfiltration

• exfiltration-cloud-tokens