T1027.013

Obfuscated Files or Information: Encrypted/Encoded File

discovered 2026-05-28

XOR encryption with 8-byte key [90, 60, 126, 18, 159, 75, 109, 138] used to encrypt embedded configuration including C2 address and HuggingFace token.

View on MITRE ATT&CK

Seen in packages

Campaigns