discovered
Dependency-confusion impersonation of Sberbank's internal SberPay payment widget, published by t-in-one. Version 99.5.8 is latest; 99.5.7 also published 2026-05-29; scope pre-staged with benign-versioned 99.0.7 on 2026-05-04. Confirms the campaign's financial-sector / Russian-market targeting. Same C2 and X-Secret as the rest of the campaign.