Post #3922779
2026-07-19 00:03 UTC
4/ the obfuscation was the same trick every time: xor/base85 → zlib → a marshalled code object → exec(). runs in memory, never writes a .pyc. so it stops you reading the source, but not running it. and anything you can run, you can hook :)
Replies (1)
-
@NeuroWinter@infosec.exchange 2026-07-19 00:03
5/ once i could read them i saw the targets: news sites, ads, local govt sites. and the endpoints matched across repos, same hand-rolled toolchain, different authors. qlk wasn’t a one-off. it was one corner of a whole scene.