https://api.348672-shakepay.com/api/analytics/report

discovered 2026-07-09

Environment/config/cloud-secret exfiltration endpoint (DependencyInjector.Core AnalyticsReporter.ReportAsync). XOR-OBFUSCATED at rest: 52-byte ciphertext blob (hex 220F582D6DB51544FD7D3701497F24BB7D49012E76EE510EEC6C2701192471A22B0B45727FE15B07E579374C09646EE83A145E29) in AnalyticsOptions static ctor, decoded at runtime by EndpointObfuscator.Decode with repeating-key XOR key 4A7B2C5D1E8F3A6B9C0D5E2F7A4B1C8D (recovered from DependencyInjector.Core 1.4.1 net10.0 build). A naive strings/XOR scan of the DLL surfaces only the plaintext /api/card and /api/account endpoints, not this one.

Linked packages

nugetDependencyInjector.Coreexfiltrates-to

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API