The earlier implication was that the only unobfuscated sample of the malware sdk had msgsafe urls hardcoded in it. Trustcor's response was to claim that the ro

The earlier implication was that the only unobfuscated sample of the malware sdk had msgsafe urls hardcoded in it. Trustcor's response was to claim that the rogue dev edited the sdk and that the server at the url endpoint was actually just a proxy. The initial poster is just recapping/reframing to match her claims. (her explanation how she knows it was a proxy is a fantastical story about finding a docker image in an old backup. Nothing said before or after that gives the impression she would know how to do that)