Poisoned Pipeline / Incidents / AS124
loltestpad campaign (ixpresso-core / exiouss)
SafeDep: same attacker published ixpresso-core (WhatsApp-agent lure,
Veltrix Windows RAT) and later exiouss, an exam-cheat cookie stealer.
Mapped techniques
- T0109 Publish malicious artifact
- T0136 Brandjacking
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
supply-chain campaign
ixpresso-core and exiouss.
WhatsApp agent and exam-cheat lures.
Veltrix Windows RAT.
Cookies, Discord, keystrokes.