url

http://45.137.198.133/0/body

discovered 2026-09-30

XOR-encoded Node stealer (key YU7m{rE/>|==b>#~). Installs axios and socket.io-client to ~/.node_modules and bootstraps Python.

Campaigns