Details
The package's bin entries (`wormgpt-cli`, `wormgpt`, `deepholegpt`, `wgpt`) map to `bin/victim.js`, which silently spawns a detached implant on any invocation (including `--help`/`--version`). The implant connects to a hardcoded C2 at http://13.60.13.215:7771 over an AES-256-GCM/HMAC-signed protocol with pool failover and a DNS TXT dead-drop channel (`protocol.js` `pollDnsDeaddrop`) that rotates the C2 URL and shared secret at runtime. On beacon, `implant.js` `gatherInfo()` collects hostname, user, OS, architecture, PID, cwd, home, LAN IP, admin flag, and a persistent victim_id, and accepts opcodes for shell/PowerShell execution, interactive PTY reverse shell, file up/download, keylogging (`GetAsyncKeyState` PowerShell loop), clipboard capture, screenshots, LAN lateral-movement scanning, privilege-escalation checks, and anti-forensics wipe. `stealers/browser.js` reads Chrome/Edge/Brave/Opera/Vivaldi Login Data SQLite databases, decrypts DPAPI-protected passwords via PowerShell with an AMSI bypass stub (`AMSI_BYPASS_B64` base64 blob run through `powershell -EncodedCommand`), parses Firefox `logins.json`, and regex-scans Discord/Chrome LevelDB for auth tokens (`/[\w-]{24}\.[\w-]{6}\.[\w-]{27}|mfa\.[\w-]{84}/g`), exfiltrating results via C2 opcode OP_BROWSER_DATA. `persist.js` installs persistence across six autostart layers per OS: Windows HKCU/HKLM Run keys, Startup.lnk, WMI __EventFilter/CommandLineEventConsumer permanent subscription, scheduled tasks, and hidden `Windows Helper` directories via `attrib +H +S`; Linux XDG autostart, systemd --user units, `@reboot` crontab, shell RC injection (`.bashrc`/`.zshrc`/`.profile`/`.xinitrc`), and `/etc/rc.local`; macOS LaunchAgent plist with KeepAlive and Login Items via osascript. `loader.js` runs a watchdog sibling process (poll every 20s, `MAX_REVIVES = 50`) plus `uncaughtException` respawn to keep the implant alive.