Fallout in python, this week

What we caught this week while monitoring over 155,936,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

YESTERDAY

Mon Sep 21 · 13 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/discoveryobjectives/command-and-controlmicro-behaviors/datamicro-behaviors/osmicro-behaviors/processobjectives/exfiltrationobjectives+1 1d
rrs 0.4.105 python and 3 siblings biggest campaign ✓ 1 day ago

Exfiltrates screen captures to Discord

messaging/webhookcredential/platform
micro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/collectionmicro-behaviors/datamicro-behaviors/osmicro-behaviors/dylibobjectives/evasionobjectivesobjectives/exfiltration+1 1d
pullgetsage 0.1.2 python ✓ 1 day ago

Steals Telegram data, exfiltrates

http/archiveindicator-removal/cleanup
micro-behaviors/communicationsmicro-behaviorsmetadata/buildmalware/appmalwaremetadataobjectives/anti-staticobjectives/command-and-controlobjectives/executionobjectives/persistenceobjectives+24 1d
skcapstone 0.15.168 python 1 day ago

curl-pipe-sh, credential theft, persistence

service/systemdautomation/agent
micro-behaviors/communicationsmicro-behaviorsmetadata/importmetadataobjectives/discoverymicro-behaviors/processmicro-behaviors/datamicro-behaviors/hardwaremicro-behaviors/osobjectives/exfiltrationobjectives+1 1d
rrs 0.4.108 python ✓ 1 day ago

Exfiltrates screen capture to Discord

messaging/webhookcredential/platform
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories