url
https://metrics.femboy.energy/v1/collect
discovered 2026-07-24
Import-time credential-stealer C2 / exfil endpoint (HTTP POST). Statically decoded from a base64-then-XOR (key 'tf_compat_v2') constant at mrmustard/__init__.py:33. Attacker-controlled; do not contact.
