Threats Tagged 'mal-2026-15674'

This package presents itself as a "System binary configuration tool" — that is its entire manifest description, with keywords system, binary, util and config, an author of "SysDev", and no repository. What it actually installs is a concealed clipboard and screen harvester that elevates itself to Administrator. The chain was read directly. package/index.js probes for a Python interpreter and, if none is found, installs one along with libraries for clipboard access, screen capture, input synthesis and Windows UI Automation — without prompting. It then launches package/start_tool.vbs, whose ten lines are unambiguous: it builds a command to run pointer.py and executes it through ShellExecute with the verb "runas" and a window style of 0, which is to say with User Account Control elevation and no visible window. The author's own comments alongside that line say, in Hinglish, to run the tool silently in the background with admin rights. package/pointer.py then creates windows with blank titles, always-on-top, and with the window manager's decorations suppressed, so nothing appears in the interface. It reads the clipboard on a timer and, whenever the contents change and exceed a few characters, hands the text to a background thread that posts it to https://new-pointer.vercel.app/api. The same endpoint receives base64-encoded screen captures and text scraped from other applications' windows through UI Automation. The response is then typed back into whatever the user is focused on, with randomised delays to mimic human typing. Nothing about clipboard access, screen capture or network transmission appears in the package description, and there is no README. The deception is the decisive element: a tool that genuinely offered this functionality would say so, and would not need to hide its window, blank its title, or elevate itself silently. The three file digests cited were recomputed from the raw registry tarball rather than taken on trust. Note there is no install hook — the chain runs when a user invokes the command — but the package is the only publish from this account and holds the latest tag. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (27d5222c88a054b79475a0415cdc3a809f3fb7ddee582f9c20836e482725a9b8) bamru declares itself a 'System binary configuration tool' but on install/run silently provisions a Python 3.12 runtime (via winget, or by downloading python-3.12.3-amd64.exe from python.org to %TEMP% and running it with /quiet) and launches a bundled pointer.py under a hidden, elevated shell. Launch goes through start_tool.vbs, which calls ShellExecute on cmd.exe with the 'runas' verb and window mode 0 to run pointer.py admin-elevated with no visible window. pointer.py monitors the clipboard (pyperclip.paste), captures screenshots (ImageGrab/mss), and walks the Windows UI Automation tree (auto.WalkControl) to scrape text from whatever application is focused, then POSTs that data over a persistent requests.Session to the hardcoded endpoint https://new-pointer.vercel.app/api. The endpoint's response drives subsequent pyautogui/keyboard input on the installer's active window, giving the remote party a control channel that types into the user's session. The UI is deliberately concealed: Tk windows use empty titles, overrideredirect(True), transparentcolor='white', and alpha 0.75 to render an invisible overlay, with comments labeling this 'Stealth'/'HACK' and a keyboard.add_hotkey('9+q', panic_exit) escape. The stated package purpose does not require a silent runtime install, admin elevation, hidden windows, whole-screen/clipboard/UI scraping, or a hardcoded remote endpoint.