tinkoff-pfp-atom-desktop-carousel@20.8.8

Analysis

tinkoff-pfp-atom-desktop-carousel@20.8.8 is a trojanized package that downloads and executes a second-stage binary payload. Upon being required, _loader.js determines the victim's platform (Linux x64/arm64, macOS, Windows), then attempts to fetch a platform-specific binary from a rotating set of Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to /pkg/package (or /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). If HTTP fails, it falls back to a DNS TXT-based payload delivery channel via c[.]tin[.]dl[.]well1[.]site, which serves chunked base64-encoded data. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process (cmd.exe /c start /b or /bin/sh -c ... &) with stdio discarded. A cache marker at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-execution within ~20 seconds. The package contains a decoy index.js exporting a dummy class and an 81KB fake analytics SDK (lib/telemetry.js) that is never invoked.