Campaign · active

Repeated static TTP

Correlated evidence: js_split_join_obfuscation:array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

First seen 2026-05-28 · last seen 2026-06-03