@emcd-vue/auth

discovered 2026-06-01

Wave 3 dropper published by emcd-vue on 2026-06-01. Version 6.4.8 (137.5 KB, entropy 5.04) is the original WaCk/JScrambler-obfuscated dropper. Version 6.4.9 (13.3 KB) is a lighter re-publish 22 minutes later with the same logic, used for static analysis recovery. Both carry the same X-Secret (l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1) and report to oob.moika.tech. Payload written to ~/.emcd-vue_init.js; FUSION_ env-var protocol passed to second stage.

Threat types

dependency confusion
credential stealer
data exfiltration
c2 agent
persistence

Malicious versions

6.4.8
6.4.9
7.1.0

Campaigns

oob-moika-tech-depconf-2026attributed-to

Indicators

urlhttps://oob.moika.tech/reportexfiltrates-to
domainoob.moika.techcommunicates-with
file path~/.emcd-vue_init.jsdrops
emailemcd-vue@proton.meattributed-to
domainemcd-vue.iocommunicates-with
sha2563a24e0fd22dce86e897b09cdb146514a0dcf2430a5d3f307c6b5959155c34b33indicates

Techniques

ttpWaCk/JScrambler JavaScript obfuscationuses
ttpStructured env-var capability handshake to second stageuses
ttpHome-directory payload persistenceuses
ttpDeliberate kill-switch mismatch (non-functional README opt-out)uses
ttpPlausible version number evasionuses
ttpT1195.001 Compromise Software Dependencies and Development Toolsuses
ttpT1036 Masqueradinguses
ttpT1497 Virtualization/Sandbox Evasionuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API