… The final payload is a Rust-based infostealer that targets the following sensitive data: Browser data from Chromium- and Gecko-based browsers e.g., cookies, saved passwords, encryption keys, browsing data, session tokens Discord tokens, local databases, and master keys Cryptocurrency wallets and wa… …
… The Laravel Lang packages are third-party localization packages and are not part of the official Laravel project. …
… The malware is heavily obfuscated and fingerprints infected systems, collects environment variables and sensitive local files, compresses the stolen data into archives, and exfiltrates it through DNS TXT queries. …
… The key new feature in the current variant is the TON-based communication with the operator, which uses .ADNL addresses routed through an embedded local TON proxy running on the infected device. …
… If CanisterWorm landed on machines that matched Iran's timezone and locales, it would wipe it. …