Another malware repository

Question

Through an interview, a scammer has unleashed a malware on me.

The malware repo is at:

https://bitbucket.org/hpenvynb/gamba_multichain_demo/src/master/

In this file:

https://bitbucket.org/hpenvynb/gamba_multichain_demo/src/master/server/controllers/paymentController.js

Specifically, the code causes an error, that is caught in the exception, that then runs the code received using eval, which then installs Python and a remote access malware.

The domain zkservice.cloud referenced in paymentController.js doesn't exist anymore, but please take necessary action to prevent it being unleashed on others.

@Andy Heinzer

chuacw · Answer

Thanks, Andy!

Andy Heinzer · Answer

I have forwarded this report to https://www.atlassian.com/trust/report-abuse

I cannot action this myself, but that team should be able to review this further.

Andy