oob.moika.tech
C2 infrastructure for all 162 active-payload packages. Hosts the /report exfiltration endpoint and /payload/{mac|win|linux}.js second-stage scripts.
discovered 2026-05-28
Campaigns
Linked packages
- npm@cloudplatform-single-spa/billingcommunicates-with
- npm@car-loans/mobile-car-loans-applicationcommunicates-with
- npm@mlspace/shared-storagecommunicates-with
- npm@fb-deposit/form-depositcommunicates-with
- npm@debit-ib/mobile-debit-ib-additional-card-formcommunicates-with
- npm@t-in-one/add_applicationcommunicates-with
