T1567 5
- Malicious Chrome Extension Steals Meta Business Manager Exports and TOTP 2FA Seeds
- Malicious Chrome Extension Exfiltrates Seed Phrases, Enabling Wallet Takeover
- Malicious Go Module Disguised as SSH Brute Forcer Exfiltrates Credentials via Telegram
- Malicious Koishi Chatbot Plugin Exfiltrates Messages Triggered by 8-Character Hex Strings
- Weaponizing OAST: How Malicious Packages Exploit npm, PyPI, and RubyGems for Data Exfiltration and Recon