log-taker@0.0.7

Analysis

log-taker@0.0.7 is a credential and information stealer that scans the local filesystem for sensitive files and exfiltrates them to a remote C2. On execution, it enumerates home directories (Linux /home, macOS /Users) and all drives (Windows C:-J:) searching for .env files, Solana wallet files (id.json), config.toml, and documents containing wallet-related keywords (seed, mnemonic, privatekey, keystore, metamask, phantom). It collects shell history from bash, zsh, fish, and PowerShell. On Windows and macOS it also exfiltrates the Telegram Desktop tdata folder (session/auth keys), packed as a gzip archive. All stolen data is uploaded via multipart POST to hxxps://log-taker[.]store/api/v1, including the target's username and platform metadata.