CodeCash

@L0Psec @malwrhunterteam I got phished from this. I think everything was cleaned. Does anyone have more info or details on what it's targeting specifically? I rotated most credentials everywhere, but might have forgotten minor things.

More "phefuckxiabot" macOS stealer stuff. The C2 domain on the Telegram account has changed to kys\.li. thanks @malwrhunterteam for sharing. I reported this telegram account and the related steam account back on 10/28... and still active DDR usage... 🧵