T1140

Deobfuscate/Decode Files or Information

Runtime per-call-site decryption of ~86 environment-variable names and 20+ credential file paths individually.

discovered 2026-06-01
View on MITRE ATT&CK ↗

Seen in packages

Campaigns