sensivity@2.5.2

Analysis

sensivity@2.5.2 is a credential-harvesting/scam toolkit that persists on the victim machine. launcher.js loads an 85KB obfuscated payload (server.obf.js) via eval(fs.readFileSync('server.obf.js','utf8')), masquerades its process as 'Runtime Broker', installs registry persistence at HKCU\Run under 'OneDriveUpdate', and deploys OneDrive.Standalone.Updater.vbs to silently relaunch via wscript. It detects Chrome YouTube windows to trigger a QR-code display (a YouTube-scam credential-harvesting pattern), ships a 6.8MB native sens.node binary, and embeds a license-auth endpoint with a public key.