T1071.001
Application Layer Protocol: Web Protocols
discovered 2025-01-16Web-protocol exfiltration. EARLIER static hypothesis: HTTPS exfil with spoofed Mozilla/5.0 UA from a self-contained browser stealer. CORRECTED (Amazon Inspector): the Linux/macOS Rust infostealer second stage POSTs stolen data as multipart/form-data over HTTP using the minreq library, gated behind anti-VM checks.
Seen in packages
- npm chrome-api-utilsuses
- npm grafana-sentry-datasourceuses
- npm @patternfly-v5/patternflyuses
- npm electron-builder-13uses
- npm graphql.vscode-graphql-syntaxuses
- npm mattermost-cloudnative-bootstrapperuses
- pypi bitensoruses
- pypi bittenso-cliuses
- pypi qbittensoruses
- pypi bittensouses
- npm nxuses
- npm @nx/jsuses
- npm @ctrl/tinycoloruses
- npm @zapier/zapier-sdkuses
- npm @asyncapi/specsuses
- npm @quick-start-soft/quick-markdown-printuses
- npm @quick-start-soft/quick-markdownuses
- npm @quick-start-soft/quick-remove-image-backgrounduses
- npm @quick-start-soft/quick-git-clean-markdownuses
- npm @quick-start-soft/quick-document-translatoruses
- npm @quick-start-soft/quick-markdown-imageuses
- npm @quick-start-soft/quick-task-refineuses
- npm @asyncapi/modelinauses
- npm posthog-react-nativeuses
- npm posthog-nodeuses
- npm @postman/secret-scanner-wasmuses
- npm @postman/csv-parseuses
- npm @postman/node-keytaruses
- npm @postman/tunnel-agentuses
- npm @postman/wdio-allure-reporteruses
- npm @postman/postman-mcp-cliuses
- npm @postman/mcp-ui-clientuses
- npm @postman/wdio-junit-reporteruses
- npm @postman/pm-bin-macos-arm64uses
- npm @postman/pm-bin-linux-x64uses
- npm @postman/aether-iconsuses
- npm @Schedaero/shareduses
- npm pino-sdk-v2uses
- npm react-refresh-updateuses
- pypi litellmuses
- npm oc-aa-module-clientuses
- npm @wame/ngx-adfsuses
- npm @the-coca-cola-company/ngps-global-common-utilsuses
- npm cr-static-shared-componentsuses
- npm @ceeferenderer/fe-renderer-sdkuses
- pypi telnyxuses
- npm axiosuses
- npm express-session-jsuses
- npm mgcuses
- npm strapi-plugin-cronuses
- npm strapi-plugin-configuses
- npm strapi-plugin-serveruses
- npm strapi-plugin-databaseuses
- npm strapi-plugin-coreuses
- npm strapi-plugin-hooksuses
- npm strapi-plugin-monitoruses
- npm strapi-plugin-eventsuses
- npm strapi-plugin-loggeruses
- npm strapi-plugin-healthuses
- npm strapi-plugin-syncuses
- npm strapi-plugin-seeduses
- npm strapi-plugin-localeuses
- npm strapi-plugin-formuses
- npm strapi-plugin-notifyuses
- npm strapi-plugin-apiuses
- npm strapi-plugin-sitemap-genuses
- npm strapi-plugin-nordica-toolsuses
- npm strapi-plugin-nordica-syncuses
- npm strapi-plugin-nordica-cmsuses
- npm strapi-plugin-nordica-apiuses
- npm strapi-plugin-nordica-reconuses
- npm strapi-plugin-nordica-stageuses
- npm strapi-plugin-nordica-vhostuses
- npm strapi-plugin-nordica-deepuses
- npm strapi-plugin-nordica-liteuses
- npm strapi-plugin-nordicauses
- npm strapi-plugin-finsevenuses
- npm strapi-plugin-hextestuses
- npm strapi-plugin-cms-toolsuses
- npm strapi-plugin-content-syncuses
- npm strapi-plugin-debug-toolsuses
- npm strapi-plugin-health-checkuses
- npm strapi-plugin-guardarian-extuses
- npm strapi-plugin-advanced-uuiduses
- npm strapi-plugin-blurhashuses
- pypi hermes-pxuses
- npm @fairwords/websocketuses
- npm @fairwords/loopback-connector-esuses
- npm @fairwords/encryptionuses
- npm @velora-dex/sdkuses
- npm sjs-bigintegeruses
- npm sjs-lint-build1uses
- npm bjs-bigintegeruses
- npm bjs-lint-builderuses
- npm bjs-lint-buildersuses
- npm cjs-bigintegeruses
- npm ts-lint-buildsuses
- npm @genoma-ui/componentsuses
- npm rrweb-v1uses
- npm @needl-ai/commonuses
- npm dom-utils-liteuses
- npm centraloggeruses
- npm forge-jsxuses
- npm @johntaohunter/forge-jsxuses
- npm js-logger-packuses
- npm ixpresso-coreuses
- npm godsplanuses
- npm eyevoxuses
- npm @cap-js/sqliteuses
- npm @cap-js/postgresuses
- npm @cap-js/db-serviceuses
- npm mbtuses
- npm npm-global-utiluses
- pypi pytorch-lightninguses
- npm exioussuses
- npm common-tg-serviceuses
- npm ams-sskuses
- npm node-env-resolveuses
- npm martinez-polygon-clipping-tonyuses
- npm noon-contractsuses
- npm iceberg-javascriptuses
- npm supabase-javascriptuses
- npm auth-javascriptuses
- npm microsoft-applicationinsights-commonuses
- npm ms-graph-typesuses
- npm node-ipcuses
- pypi durabletaskuses
- npm polymarket-trading-cliuses
- npm polymarket-terminaluses
- npm polymarket-tradeuses
- npm polymarket-auto-tradeuses
- npm polymarket-copy-tradinguses
- npm polymarket-botuses
- npm polymarket-claude-codeuses
- npm polymarket-ai-agentuses
- npm polymarket-traderuses
- npm forge-jsxyuses
- npm forge-jsx4uses
- npm pino-zoduses
- npm zod-pinouses
- npm compose-logger-standuses
- npm zod-pino434uses
- npm zod-pino444uses
- npm zredis-typeduses
- npm pinokio-redisuses
- crates oneringuses
- npm @mastra/coreuses
- npm easy-day-jsuses
- npm procwireuses
- npm staticlayeruses
- npm apintergrationpostuses
- npm @apexcraft/nano-keyuses
- npm paysafe-checkoutuses
- pypi paysafe-sdkuses
- go github.com/kaleidora/dnsub-scanning-tooluses
- nuget Braintree.Netuses
- nuget DependencyInjector.Coreuses
- npm @injectivelabs/sdk-tsuses
- npm @flex-ng/error-componentuses
- npm @flex-ng/filter-pipeuses
- npm @flex-ng/header-componentuses
- npm @idms-corp/auth-uiuses
- npm @logdna-web/shareduses
- npm @logdna-web/stylesuses
- npm tme-xcauses
- npm tme-xca-reactuses
- npm tme-erroruses
- npm enbd-react-loggeruses
- npm enbd-react-error-boundryuses
- npm enbd-react-libuses
- npm box-react-uixuses
- npm sams-sr-sdk-h5uses
- npm chat-adapter-zoomuses
- npm salesforce-vscode-sldsuses
- npm slds-lsp-clientuses
- npm @copilot-mcp/apexuses
Campaigns
- Pepesoftuses
- Enterprise Dependency Confusionattributed-to
- Bittensor Typosquat Campaignattributed-to
- s1ngularity nx Build System Compromiseattributed-to
- Shai-Huludattributed-to
- miasma-train-p1attributed-to
- No Specific Campaignattributed-to
- TeamPCPattributed-to
- Strapi Plugin C2 Campaignattributed-to
- fairwords Credential Wormattributed-to
- big.js Typosquat SSH Backdoorattributed-to
- tanvisoul9 npm Backdoorsattributed-to
- forge-jsx RATattributed-to
- Contagious Interviewattributed-to
- fucktestpad npm Malwareattributed-to
- Mini Shai-Huludattributed-to
- shetty123 Telegram Hijackattributed-to
- Claude Code Hook Backdoorsattributed-to
- Crypto Wallet Drainersattributed-to
- @mastra npm Scope Takeoverattributed-to
- procwire / deltajohnsons Windows Dropperattributed-to
- wshu.net npm Credential-Stealer Campaignattributed-to
- Operation Muck and Loadattributed-to
- Apex Foundationattributed-to
