Unverified50% confidenceFactExact time
The backdoor assembles a URL from Base64 fragments to conceal the real address, and downloads a platform-specific payload based on the operating system, writing it to the /Temp directory for execution.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/21/2026
First Seen
Valid until: 12/20/2026
Sources
Related Entities
Related Claims
UnverifiedIPFS采用内容寻址，每个文件通过其内容的加密哈希值（CID）来标识，不依赖于文件存储在哪台服务器上58% similarUnverifiedCryptPad的文档URL通过URL fragment（#号后的部分）传递解密密钥片段，根据HTTP协议规范fragment不会随请求发送到服务器57% similarUnverified在标准HTTPS通信模型中数据端到端加密，但中转服务器作为代理必须先解密用户请求再转发给上游API，因此平台技术上具备读取和留存所有对话内容的能力55% similarUnverified数据外泄手段包括 HTTPS POST 请求、DNS 隧道以及利用 GitHub/GitLab 公开 API 创建仓库或 Gist 存储被盗数据55% similarUnverifiedDERP relay servers can only see the ciphertext encrypted by WireGuard and cannot decrypt the actual transmitted content.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/938219API
curl https://kongchang.com/api/v1/knowledge/claims/938219MCP
get_claim(id=938219)