Post #3922777
2026-07-19 00:03 UTC
3/ Qinglong turns out to be a webui for cron jobs. “wool farmers” (薅羊毛, pulling wool) use it to run scripts on a schedule that drain loyalty points, coupons and lottery payouts from apps, then cash out on xianyu / pinduoduo. qlk was a pile of exactly these.
#Qinglong
Replies (1)
-
@NeuroWinter@infosec.exchange 2026-07-19 00:03
4/ the obfuscation was the same trick every time: xor/base85 → zlib → a marshalled code object → exec(). runs in memory, never writes a .pyc. so it stops you reading the source, but not running it. and anything you can run, you can hook :)