🎯 T1140 Deobfuscate/Decode Files or Information

The items that name it 3

• Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
  writeup2026-10-27It is written here as T1140 Deobfuscate/Decode Files or Information: C2 host rebuilt from a character-code array, base64 payload decoded.
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeup2026-10-23It is written here as T1140 Deobfuscate/Decode Files or Information: cook.py decodes at runtime.
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeup2026-10-21It is written here as T1140 - Deobfuscate/Decode Files or Information.