hxxps://api.mapbox[.]com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtuaURL
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Don't Eat the ChocoPoCs: Trojanised PoCs Hit Researchers“It then GETs a particular Mapbox dataset feature at hxxps://api.mapbox[.]com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtua (the dead-drop) using a public Mapbox token, Base64-decodes the blob from properties['dm370543acmdopk296nahbtua'] to Python…”
Indicators reported together
named in the same reports- hxxps://github[.]com/ogenich/CVE-2026-48908in 1 report
- student.uin-suka.ac[.]idin 1 report
- ogrenci.ibu.edu[.]trin 1 report
- pepy[.]techin 1 report
- pypistats[.]orgin 1 report
- 93739477cd379ade…856fa111dd06in 1 report
- 17997e9e0256d0f5…822b24aa76b4in 1 report
- 5abd45d6f4a1705d…a35c23de5caein 1 report
- 40569318e89db751…a28129ca36bcin 1 report
- 320b29844892e3c5…9e294ec6d43ein 1 report
- hxxps://github[.]com/lincemorado97/CVE-2025-64446_CVE-2025-58034in 1 report
- hxxps://github[.]com/lincemorado97/CVE-2025-55182_CVE-2025-66478in 1 report
- hxxps://github[.]com/lincemorado97/CVE-2025-14847in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2026-48908, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2025-64446, CVE-2025-14847
Thanks — we review every report.