mihailupu

4 ms·

1. 1.▲
   by mihailupu 5mo ago

   The part that surprised me most when decoding it: there's no hardcoded C2 URL anywhere in the file. It fetches the last outgoing transaction from a TRON wallet and uses the raw_data field as an XOR key to decrypt what it actually runs.
2. 2.▲
   An AI coding agent injected blockchain dead-drop malware into my repo(gist.github.com)

   3 points by mihailupu 5mo ago|1 comments