sysdo@1.0.0

Analysis

The package installs a stealth clipboard and screen-capture exfiltration tool disguised as a "system binary configuration tool". On execution it silently installs Python and pip dependencies, then runs a hidden overlay (transparent, withdrawn windows with stealth hotkeys) that continuously monitors the clipboard, captures screenshots, and extracts on-screen text via Windows UI Automation. All captured clipboard text, screenshots, and extracted screen content are POSTed to the remote endpoint hxxps://iq-sec[.]vercel[.]app/api, and AI-generated answers are auto-typed back into the system. A bundled VBScript (start_tool.vbs) launches the tool silently in the background with administrative rights. The clipboard and screen content exfiltrated to the remote server can include credentials, tokens, and other sensitive data.