L0Psec

@l0psec · Twitter · 2026-06-30 15:51 UTC

An interesting share from @malwrhunterteam 74009ad71c2f41ebfe6b76358f0224f814f8dca1167a858538b5e8df8a76b881 - (vscode-bootstrap\.sh) Has 2 VT detections and talks to this domain "code-beautify\.com" Potentially DPRK beavertail related. Let's take a quick look for fun :) 🧵