SlowMist Flags GitHub Repo Posing as Qwen 3.8 27B Model in Malware Campaign

SlowMist Security Team said it found a GitHub repository impersonating the Qwen 3.8 27B local quantized model. The repository claimed the model should exceed 16 GB, but the downloaded content was only about 487 KB and included disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. According to Odaily, SlowMist said the official Qwen project was not compromised. The malicious program collects host data, captures screenshots, and sends them to an attacker-controlled C2 server. When the hardcoded server is unavailable, it reads a backup C2 address from a Polygon smart contract, allowing the attacker to rotate infrastructure through on-chain transactions. SlowMist said later payloads can steal browser login data, cookies, browsing history, email, WinSCP and Steam credentials, as well as wallet-related files and extension data.