discovered 2026-06-24
Decrypted worm payload (_p blob), identical across all 20 LeoPlatform infected packages (781,580 bytes)