# E01. Master investigation report

## Scope and material

The investigation began with three phishing messages received on 22 June and 21–22 July 2026. The corpus includes lures, delivery repositories, payloads, administration source and targeting databases. The evidence cutoff is 24 July 2026. This is an edited synthesis of the master record. [S1]

## Delivery and collection

Two documented delivery mechanisms are a recruitment-page clipboard substitution and a repository-triggered editor-extension pipeline. These replace verification text with an installation command or deploy a VSIX masquerading as Google Update Support. Execution depends on permissions and platform conditions. A third, archive-based ECHOES strand retains staging and configuration history but lacks its final payload. [S1]

Recovered collection components reference browser databases, wallet material, developer credentials and a broader filename-based secret search. Windows source includes an elevation attempt and browser-decryption logic; capture-related artifacts support a screen-streaming capability assessment. None of these static observations establishes successful collection from a particular endpoint. E02–E05 and E17–E19 document these mechanisms.

## Infrastructure, administration and targeting

A GitLab-hosted JSON resource provides C2 configuration separately from the deployed payload. Recorded history includes a July destination change. Historical observations associate distinct addresses with lure hosting, C2 and administration; these are dated service relationships rather than proof of exclusive ownership. Recovered frontend source contains mail metrics, delivery-repository status views and wallet-claim interfaces. Backend code and transaction evidence were not recovered with that frontend. [S1]

The two targeting pools contain 79,698 and 62,667 rows. Read-only verification recorded in the preprint gives 142,365 distinct stored address strings, no exact address overlap, and 27,698 distinct repository values. These are targeting-data measures, not counts of people, delivered messages, infections or financial losses. E08 specifies the aggregate queries and their limitations. [S2]

## Corrections and evidentiary limits

The preprint qualifies several stronger statements in the master record. A resolver does not guarantee that every client follows every update. Capture symbols do not establish a recorded screen session. A frontend privilege check does not establish server-side authorization. Shared hosting does not establish a common operator, and build metadata does not locate a person. Equivalence with G1052 and real-world operator identity are not established. [S2]

The record distinguishes filed preservation requests from drafts. No new outreach, payload execution or infrastructure checks were performed to prepare this report. Withheld raw inputs limit independent replication.