Synthèse
This module performs a recursive file sweep targeting various documents and files from developer machines. On Windows, this module is more aggressive and has a larger blast radius, while on macOS/Linux, drive enumeration is skipped and it only targets home directories. Before scanning, the malware enumerates the mounted drives on the system using the following WMI query: wmic logicaldisk get name Next, the malware scans each collected root drive from the previous wmic query or the home directori
This module performs a recursive file sweep targeting various documents and files from developer machines. On Windows, this module is more aggressive and has a larger blast radius, while on macOS/Linux, drive enumeration is skipped and it only targets home directories. Before scanning, the malware enumerates the mounted drives on the system using the following WMI query: wmic logicaldisk get name Next, the malware scans each collected root drive from the previous wmic query or the home directories on other platforms, searching for the following files whose names match a set of glob patterns: *. env*, *. doc, *.
docx, *. pdf, *. md, *. rtf, *. odt, *.
xls, *. xlsx, *. txt, *. pem, *. ini, *.
secret, *. png, *. jpg, *. jpeg, *. webp, *.
json, *. ts, *. js, . zsh_history, . bash_history, *.
csv In addition, any file whose path contains one of the following credential-store or shell-history locations is collected regardless of its extension: . aws, . azure, . config, . ssh, .
bash_history, . zsh_history Ultimately, this file stealer targets sensitive information stored on developer machines, including credentials, configuration files, shell histories, documents, images, and source code. If any of the file patterns get matched, the files are sent through POST requests to the /upload endpoint using the domain (upload. rightwidth[. ]dev).
The files themselves aren’t additionally encrypted or compressed by the malware when sent over the network. Below is an example of a . txt exfiltrated through this module: The following file extensions and file paths are excluded from this file exfiltration module. There is a deliberate scoping decision in which the threat actors seek to maximize their signal and minimize noise. The list also confirms that this group is in tune with the current developer ecosystem, avoiding AI coding tooling extensions such as .
claude, . cursor, . gemini, or . windsurf. "node_modules", "npm", "hooks", "android", "example", "AppData", "vendors", "vendor", "public", "css", "less", "scss", ".