MSC-2026-11507
Published:August 27, 2026
Updated:August 27, 2026
Stage-1 loader for a staged infostealer chain. Impersonates hyperweb-io/chain-registry (homepage + 'Theta chain registry' description); its only added behavior is importing HttpProvider from supersignaturenature@^1.0.6, whose dist/ bundles DES-decrypt an embedded blob with hardcoded password and pipe the plaintext into a detached node process with stdio ignored. Stage 2, decrypted statically, silently npm-installs better-sqlite3 + @primno/dpapi + koffi + axios + socket.io-client into ~/.vs_cache and launches it hidden via wscript.exe. Payload carriers: supersignaturenature, manager-thedate, tchain-api. Verified by static diff analysis only (diff a1340412); nothing executed.
Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Exploit Maturity
HIGH
Weakness Type (CWE)
Trojan Horse