{"id":3999,"date":"2026-07-30T16:11:46","date_gmt":"2026-07-30T20:11:46","guid":{"rendered":"https:\/\/drkeithjones.com\/?p=3999"},"modified":"2026-07-30T16:11:50","modified_gmt":"2026-07-30T20:11:50","slug":"polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration","status":"publish","type":"post","link":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/","title":{"rendered":"Polish &#8220;Powiadomienie&#8221; JS Campaign \u2014 Credential Theft via FTP Exfiltration"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Join me as I walk through the malware sample and PCAP \u2014 breaking down the obfuscation, tracing the anti-sandbox check, and following the FTP exfiltration start to finish using Zeek, DuckDB, and a little healthy skepticism.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Full slides: <a href=\"https:\/\/www.UnpackThePCAP.com\">https:\/\/www.UnpackThePCAP.com<\/a><br>PCAP: <a href=\"https:\/\/app.any.run\/tasks\/cf79e9ca-1970-432f-a51f-502d2d5e5606\/\">https:\/\/app.any.run\/tasks\/cf79e9ca-1970-432f-a51f-502d2d5e5606\/<\/a><\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Polish JS Malware: They Stole Passwords via FTP in 3 Seconds (Powiadomienie Deep Dive)\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/ThFJ3UjKCJA?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Transcript:<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">00:00:00:00 &#8211; 00:00:15:21<br>Keith<br>Welcome to Unpack the PCAP. I&#8217;m Keith, let&#8217;s open up another traffic capture. So this one, it&#8217;s date is June 15th, 2026. And the title of this one is Polish. I&#8217;m going to try and pronounce<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:00:15:25 &#8211; 00:00:30:39<br>Keith<br>it Powidomienie JavaScript campaign credential theft via FTP. So Powidomienie means notification in Polish, but this email ain&#8217;t delivering good news.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:00:30:44 &#8211; 00:00:43:54<br>Keith<br>The only thing this email is delivering is bad decisions and stolen credentials. In Poland, notification apparently means I&#8217;m about to steal all your Firefox passwords. Just a slight cultural translation issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:00:43:59 &#8211; 00:00:53:54<br>Keith<br>So this is the link. I registered a domain. UnpackThePCAP.com and you can go here., and you can get all the slides and everything that I talk about in these videos.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:00:53:57 &#8211; 00:01:14:59<br>Keith<br>Before we dive in, I need to be clear about where this data comes from. All data here is from publicly available sources. It&#8217;s published by ANY.RUN in their public sandbox. We also downloaded the malware sample itself from any.run. And we do a little bit of an analysis and show you that. The analysis report is at the link above in the slides.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:01:14:59 &#8211; 00:01:31:01<br>Keith<br>And this is why you want to go to that website, because all these slides that you get to, they&#8217;re all clickable. And you can get all the links and everything that I talk about. And in here every domain, IP hash and command is going to be backed by the PCAP itself. You can download it from any.run just like I did.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:01:31:09 &#8211; 00:01:49:21<br>Keith<br>And the malware sample. We&#8217;re going to do some simple static analysis. You know, just some file, MD5, strings, and things like that against it. The Zeek logs we generate by running Zeek against this PCAP. It&#8217;s pretty much that simple. Packet level analysis will do with tcpdump,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:01:49:23 &#8211; 00:01:52:46<br>Keith<br>and nothing here is going to be made up. Nothing speculative.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:01:52:51 &#8211; 00:01:57:32<br>Keith<br>If I wanted to write fiction, I charge more for it and I get fewer virus notifications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:01:57:37 &#8211; 00:02:14:35<br>Keith<br>All right. Walking through the infection chain as we&#8217;ll see in the PCAP. Number one the JavaScript file arrives likely via email. So it&#8217;s something out of band not in this PCAP. So if you look at this PCAP you won&#8217;t see how the JavaScript gets there. You just have to assume that it&#8217;s there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:02:14:39 &#8211; 00:02:25:20<br>Keith<br>Stage one. Once the JavaScript runs, the malware checks if it&#8217;s in the sandbox via ip-api.com, and then stage two it resolves ftp<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:02:25:25 &#8211; 00:02:35:41<br>Keith<br>dot telewate-pe.com to find at C2 server. Stage three it exfiltrate stolen data via FTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:02:35:46 &#8211; 00:02:44:24<br>Keith<br>It&#8217;s a simple chain devastating outcome, like stepping on a single Lego in the dark. Simple and design devastating and execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:02:44:29 &#8211; 00:02:58:13<br>Keith<br>We downloaded the sample from any.run and did some cursory analysis. Just file type and hash to see what we&#8217;re dealing with, and it tells you it&#8217;s Unicode text. 3.6MB on a single line.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:02:58:18 &#8211; 00:03:08:01<br>Keith<br>Typical for heavily advocated JavaScript. It&#8217;s MD5. You can see right there on the slide. I&#8217;m not going to read it for you, but it matches the any dot run report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:03:08:06 &#8211; 00:03:32:05<br>Keith<br>Okay, so a dropper is a small piece of malware whose only job is to download or write or unpack a larger payload onto the system. It drops the real malware and itself often disappears afterwards. So strings analysis is one of the fastest way we can understand what a malware does without running it, and even heavily obfuscated code often used<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:03:32:15 &#8211; 00:03:47:24<br>Keith<br>or it leaves readable strings behind like ActiveX program IDs, file paths, and command lines. So a quick strings command can sometimes tell you if it&#8217;s a dropper, a key logger, a rat, or something else.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:03:47:29 &#8211; 00:04:02:12<br>Keith<br>The next slide breaks down exactly what each of those strings tells us. Why wscript.shell, FileSystemObject, Base64 and schtask together revealed a JavaScript dropper with persistence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:04:02:17 &#8211; 00:04:09:17<br>Keith<br>Normally, when software advertises its capabilities, it&#8217;s called a feature list. What malware does it? It&#8217;s called an IOC list.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:04:09:22 &#8211; 00:04:20:17<br>Keith<br>Let&#8217;s break down what those strings tell us about the malware capabilities. Wscript.shell can run commands via the cmd.exe. So we&#8217;re talking about windows here.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:04:20:22 &#8211; 00:04:42:34<br>Keith<br>Scripting dot file system object plus save to file can read and write files. bin.base64 has embedded encoded data to decode at runtime. schtasks, it creates a scheduled task and we know that the interval is 15 minutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:04:42:38 &#8211; 00:04:55:24<br>Keith<br>And we see this a file system directory C colon slash user slash public slash libraries. And it&#8217;s a drop directory per the. any.run analysis. If you just go check there it actually shows you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:04:55:29 &#8211; 00:05:02:50<br>Keith<br>The strings of the malware shopping list: Duct tape, rope, shovel. You know it&#8217;s not for a DIY project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:05:02:55 &#8211; 00:05:25:12<br>Keith<br>Bottom line, these strings tell us that the JavaScript can execute commands, read write files, and create persistence. The exact behavior is only visible at runtime. We can&#8217;t see the C2 URLs, FTP paths, or credentials in plain text. They&#8217;re in the 150 plus obfuscated five character array elements decoded only at runtime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:05:25:16 &#8211; 00:05:40:35<br>Keith<br>The dropped file name that starts with DWW here and ends in .ttf. Looks like random characters. The attackers name their malware like a cat that walked across the keyboard, but somehow it still works better than most enterprise software.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:05:40:40 &#8211; 00:05:48:06<br>Keith<br>Per the any of that run analysis, it\u2019s actually an executable, not a font file. That&#8217;s what TTF stands for, which is true<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:05:48:09 &#8211; 00:06:06:27<br>Keith<br>type font. So this is not a font, it&#8217;s actually an executable file. The drop location was that C users slash public slash libraries and it&#8217;s just a common hidden in plain sight directory. It just tries to blend in with everything else so investigators don&#8217;t find it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:06:06:32 &#8211; 00:06:16:20<br>Keith<br>The credential theft visible in this PCAP is consistent with the TTF payload being a credential harvester that phones home via FTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:06:16:25 &#8211; 00:06:21:46<br>Keith<br>And I know that was a long winded sentence, but I&#8217;m going to break all that down for you in the upcoming slides.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:06:21:51 &#8211; 00:06:36:51<br>Keith<br>Now let&#8217;s switch from the malware sample to the PCAP itself. Here&#8217;s what Zeek tells us about this. Traffic capture. 309kB, roughly two minutes of traffic, and we&#8217;ll confirm the duration in a moment. I&#8217;ll show you the actual command for it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:06:36:56 &#8211; 00:06:54:31<br>Keith<br>One infected workstation DESKTOP-JGLLJLD at 192.168.100.12. And we&#8217;ll show you how we know all this in a moment. Per the exfiltrated payload, this is a Windows 10 Pro machine.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:06:54:36 &#8211; 00:07:03:24<br>Keith<br>Now remember we&#8217;re getting this from any.run. So this is this victim machine is actually one of the sandbox machines. It&#8217;s not an actual real user machine.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:07:03:29 &#8211; 00:07:27:17<br>Keith<br>All right. So the first step to look at this PCAP is to run Zeek against the PCAP to generate structured logs. And the dash capital C just means ignore invalid checksums which is a common in capture traffic. It&#8217;s one of those things that I always put on there, because I don&#8217;t want to see the errors, and the dash R is read from a PCAP instead of from a live network card.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:07:27:22 &#8211; 00:07:47:55<br>Keith<br>Now the log colon colon default underscore log dir equals output. Lets me take all my Zeek logs and that dump them in the current directory, but actually put them in a different directory called output. Zeek produces separate log files for each protocol at detects. So it&#8217;s got a conn.log, which gives you an overview of all the connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:07:48:10 &#8211; 00:08:08:16<br>Keith<br>You have a DNS.log, which is all the DNS queries and responses. You have http.log, which is HTTP requests and responses, and ftp.log, which has all the FTP commands. And then you have an SSL.log which is the TLS handshake, metadata and all that kind of stuff.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:08:08:21 &#8211; 00:08:16:14<br>Keith<br>Running on a PCAP is like handing a chef a pile of groceries and getting back a plated meal, instead of throwing everything in a blender and calling it a dinner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:08:16:19 &#8211; 00:08:37:43<br>Keith<br>Before we run queries, we need to install the DuckDB Zeek extension written by Yacin Nadji. This extension provides the read_zeek function that reads in the Zeek TSV logs directly and makes your life so much easier. The Inet extension handles IP addresses as column types natively inside DuckDB.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:08:37:48 &#8211; 00:08:47:00<br>Keith<br>Duck DB fits in the Goldilocks zone of security querying. Lighter than a full database, heavier than grep and just right for asking what the hell happened here?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:08:47:08 &#8211; 00:09:18:01<br>Keith<br>DuckDB calculates the capture duration directly from the conn.log timestamps. The first connection is at 2:45:38 and the last is at 2:47:40. So about two minutes. The actual malicious activity, the IP-API check to the FTP upload of the credentials takes about two seconds, so we can narrow it down by correlating the HTTP request timestamp to ip-API with the ftp upload timestamp<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:18:01 &#8211; 00:09:22:51<br>Keith<br>in the PCAP. We&#8217;ll see the timeline on the traffic overview slide later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:22:55 &#8211; 00:09:28:12<br>Keith<br>Two seconds on the wire and the attacker already have more impact than most 30 minute meetings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:28:17 &#8211; 00:09:29:29<br>Keith<br>From conn.log,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:29:29 &#8211; 00:09:37:48<br>Keith<br>only one unique IPv4 source address exists. The rest are either IPv6 link local or they&#8217;re unspecified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:37:53 &#8211; 00:09:41:54<br>Keith<br>The victim IP stands out because it&#8217;s actually trying to connect to things.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:41:59 &#8211; 00:09:48:27<br>Keith<br>The link local addresses are just networking socially. Lots of handshakes, no real conversations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:09:48:31 &#8211; 00:10:01:15<br>Keith<br>Why this slide matters. We now know the victim&#8217;s machine is a windows host named DESKTOP- JGLLJLD. This is the malware sandbox desktop that executed the JavaScript file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:10:01:20 &#8211; 00:10:12:16<br>Keith<br>The desktop dash prefix is the default windows naming scheme used since Windows 8, and this will match the OS fingerprint that we&#8217;ll see exfiltrated later on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:10:12:20 &#8211; 00:10:38:18<br>Keith<br>How do we know that this is NetBIOS? The UDP port is 137 and this is assigned the NetBIOS name service port. Zeek logs these as the type Nimloc in DNS.log. The ID underscore resp underscore h column shows 192.168.100.255, the broadcast address. NetBIOS nodes announce to the entire subnet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:10:38:22 &#8211; 00:10:45:33<br>Keith<br>The uppercase hostname is also characteristic of NetBIOS names, 16 characters of uppercase.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:10:45:38 &#8211; 00:10:51:52<br>Keith<br>So basically the machine was wearing a name tag. Recon is usually harder than this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:10:51:57 &#8211; 00:11:15:21<br>Keith<br>Let&#8217;s run the protocol breakdown and see what services show up. We\u2019ll annotate what each service means on the next slide, but check that out. FTP. FTP in 2026 is like seeing someone using a fax machine. Technically functional, but you know they&#8217;re up to no good. The attackers either didn&#8217;t get the memo about SFTP or they&#8217;re nostalgic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:15:33 &#8211; 00:11:18:11<br>Keith<br>Either way, it&#8217;s a C2 signal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:18:16 &#8211; 00:11:26:24<br>Keith<br>Here&#8217;s the annotated view of what we found. The FTP entries are the key signal will prove each claim in the slides ahead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:26:28 &#8211; 00:11:34:45<br>Keith<br>DNS and SSL dominate normal Windows 10 background chatter. We&#8217;re going to confirm that in the SSL slide in a second.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:34:50 &#8211; 00:11:41:28<br>Keith<br>HTTP is minimal, mostly the IP dash API check, which will also show on the next slide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:41:33 &#8211; 00:11:47:36<br>Keith<br>FTP and FTP data. That&#8217;s the malicious signal. And this is proven in the stage three slides that you&#8217;ll see in a minute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:47:41 &#8211; 00:11:53:40<br>Keith<br>FTP from a modern workstation is like a payphone ringing. You answer it, but you know it&#8217;s not good news.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:11:53:45 &#8211; 00:12:29:14<br>Keith<br>Let&#8217;s verify that those 14 SSL connections aren&#8217;t C2 traffic, they&#8217;re all Microsoft. Settings dash win dot data dot Microsoft.com. Windows settings sync. You got login.live.com. That&#8217;s Microsoft&#8217;s account authentication. client.wns.windows.com. That&#8217;s a Windows Notification service and the SLS.CR.update.microsoft.com. And you got some other Microsoft.com that&#8217;s associated with Windows Update. Nothing suspicious here. This is normal Windows 10 background noise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:12:29:18 &#8211; 00:12:31:42<br>Keith<br>SSL to Microsoft is like death and taxes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:12:31:45 &#8211; 00:12:35:16<br>Keith<br>It&#8217;s inevitable and usually not a sign of compromise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:12:35:21 &#8211; 00:13:14:42<br>Keith<br>Let&#8217;s verify the rest of the HTTP traffic is benign. CRL.Microsoft.com and microsoft.com\/pkiops\/crl that stands for certificate revocation list downloads. Basically, it&#8217;s windows checking to see if HTTPS certs are still valid, and then we see some OCSP digitcert.com which is another online certificate status protocol thing. Only the ip-api.com request is suspicious. And that has the parameters of fields equals hosting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:14:54 &#8211; 00:13:19:19<br>Keith<br>And this is a telltale anti sandbox parameter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:19:23 &#8211; 00:13:26:27<br>Keith<br>Windows goes full forensic accountant on every TLS cert. Meanwhile the malware just yells the passwords across the room.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:26:31 &#8211; 00:13:35:14<br>Keith<br>Windows ran a background check on digit certs responder, but then let a JavaScript walk right in with no ID required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:35:19 &#8211; 00:13:53:21<br>Keith<br>Let&#8217;s dive into stage one. The initial trigger at 2:45:46. About eight seconds after the PCAP starts, the malware makes its first outbound call, the DNS query for ip-api.com. It resolves to 208.95.112.1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:53:26 &#8211; 00:13:55:26<br>Keith<br>The first thing the malware does is ask:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:13:55:28 &#8211; 00:14:00:23<br>Keith<br>\u201cAm I in a sandbox?\u201d, which is probably the first thing I would ask if I were a malware<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:14:00:28 &#8211; 00:14:30:23<br>Keith<br>The DNS resolves and the HTTP get follows immediately after. Let&#8217;s look at what it asked. The HTTP get to slash line slash question mark fields equals hosting. And this is a single field query to minimize footprint, I imagine. What it does is the IP-API.com that site returns whether the requesting IP, which is the malware sandbox in this case is in a hosting or a data center.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:14:30:28 &#8211; 00:14:36:01<br>Keith<br>If hosting equals true, it&#8217;s a sandbox or a VPS and the malware stops.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:14:36:06 &#8211; 00:14:52:58<br>Keith<br>If hosting equals false, it&#8217;s a residential connection. Safe to proceed. The response of false means, not a hosting provider. The malware proceeds and will see the whole FTP exchange on the next slide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:14:53:03 &#8211; 00:15:07:03<br>Keith<br>The malware asks: \u201cAm I in a sandbox?\u201d before it runs. And that&#8217;s more caution than most people show before clicking links in an email. The malware is more careful about where it runs than most people when they&#8217;re clicking on that link.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:15:07:08 &#8211; 00:15:32:39<br>Keith<br>Here&#8217;s the full HTTP exchange captured by tcpdump. The request and the response, and we can verify what the script saw by running the same query on our IP address. And you can do that with a curl command. You just go to run curl ip-api.com and you put the rest of that URL we&#8217;ve been showing on the slides up, and you&#8217;ll see it returns false for a residential IP address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:15:32:39 &#8211; 00:15:36:01<br>Keith<br>Unless you happen to be running in a data center, then it may return true.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:15:36:06 &#8211; 00:15:57:24<br>Keith<br>Per the PCAP, the script receives false and it continues execution. So in the Malware analysis sandbox, it now thinks it&#8217;s running in not a hosting environment and it continues executing. If it would have gotten true, it would have stopped. And the malware does a threat assessment before executing and the user didn\u2019t.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:15:57:29 &#8211; 00:16:14:55<br>Keith<br>The anti sandbox check passed. So the malware is going to continue. So what does the malware do next. Let&#8217;s look at what DNS queries happen right after the IP-API check at 02:45:47. One second later there&#8217;s a query for FTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:16:15:00 &#8211; 00:16:21:09<br>Keith<br>telewatte-pe.com.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:16:21:14 &#8211; 00:16:37:35<br>Keith<br>FTP is an inherently insecure. It&#8217;s got plaintext credentials. You see all the files that are being transferred without any types of encryption on it. So right there that&#8217;s worth investigating. And we&#8217;ll verify that this is the C2 in the next few slides.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:16:37:40 &#8211; 00:16:43:33<br>Keith<br>The malware passed its security check and immediately called home, which is more than I can say for my children.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:16:43:38 &#8211; 00:17:03:50<br>Keith<br>Let&#8217;s look up whois data on that C2 IP and see who&#8217;s hosting it. The whois lookup says this IP belongs to NameCheap and NameCheap is legitimate hosting provider. But attackers rent cheap VPS or compromise hosting accounts there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:17:03:55 &#8211; 00:17:28:30<br>Keith<br>And for the low, low price of $5 a month, you too can host your credential exfiltration infrastructure. The domain telewatte-pe.com does that mean anything? I don&#8217;t know, probably not. These kinds of disposable domains are common in short lived campaigns. As of today, the domain it appears to be parked so not exactly a sign of legitimate<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:17:28:37 &#8211; 00:17:34:53<br>Keith<br>business. The domain is parked, which is more than I can say for these victims credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:17:34:57 &#8211; 00:17:51:09<br>Keith<br>Stage three the actual exfiltration. So here&#8217;s the FTP session from Zeek&#8217;s FTP log. Now we see the full FTP session from Zeek\u2019s FTP.log. It has the username of coach\u2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:17:51:14 &#8211; 00:18:29:42<br>Keith<br>I&#8217;m guessing coachyrdp? That&#8217;s how it looks to me. But maybe it&#8217;s CoachyRDP. Yeah, CoachyRDP is probably more probable in the computer sense and it&#8217;s the username CoachyRDP@telewatte-pe.com. And after the authentication the malware immediately issues a store which is upload and the file name this long file name of pw underscore admin dash desktop dash JGLLJLD underscore 2006 underscore oh six underscore 16 underscore and then the time dot HTML.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:18:29:47 &#8211; 00:18:40:12<br>Keith<br>So PW underscore admin. PW is the malware prefix and admin that&#8217;s the victim&#8217;s username from the sandbox that ran this JavaScript.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:18:40:16 &#8211; 00:18:52:19<br>Keith<br>And you&#8217;ll see username admin in the payload in a minute. The desktop dash JGLLJLD. That&#8217;s the victim&#8217;s machine name that we saw earlier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:18:52:24 &#8211; 00:19:06:17<br>Keith<br>The timestamp. That&#8217;s just the string on the file. So that way if you&#8217;re uploading multiple of the same name it can be differentiated by the time stamp. And I just want to scroll to the right here so you can look at the rest of this slide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:19:06:17 &#8211; 00:19:15:04<br>Keith<br>Again I encourage you to go to UnpackThePCAP.com and go to these slides and you can follow along with me.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:19:15:08 &#8211; 00:19:40:56<br>Keith<br>And here&#8217;s the embarrassing part for the attackers. Their own credentials are in the plaintext. The FTP connection is unencrypted, the password travels and you can see it. So the password is and I&#8217;ll read it out just so it&#8217;s in the log. But it&#8217;s dot nine underscore p h equal equal a equal exclamation point b a. And this is captured in the PCAP in plaintext.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:19:41:06 &#8211; 00:19:55:28<br>Keith<br>And the attackers threw a rock from a glass house made entirely of plaintext passwords. In this case, the malware went to all that trouble to steal credentials, and then shouted its own credentials across the internet for free.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:19:55:33 &#8211; 00:20:24:57<br>Keith<br>The FTP data channel, which is port 12077, carried the stolen credentials as raw TSP data. TCPdump with the dash little n little n capital A shows the Ascii content of the packet payload, and we&#8217;re filtering to only the destination port of 12077. And that isolates the upload from the control channel that we were talking about earlier. The control channel is on port 21.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:20:25:02 &#8211; 00:20:44:47<br>Keith<br>They built a sophisticated JavaScript dropper, and then they mailed the prize home on a postcard that anybody could read going through the mail. The attacker&#8217;s OpSec spans the entire history of the internet. A modern JavaScript dropper that exfiltrates via 1971 FTP, no encryption<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:20:44:52 &#8211; 00:20:53:45<br>Keith<br>included. And the result? It&#8217;s. The result is the original file, an HTML page. It&#8217;s, you know, dot HTML extension.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:20:53:45 &#8211; 00:21:10:01<br>Keith<br>And you can see the BR and the HR tags in there. And this contains the victim&#8217;s credentials. You can see right in the middle there username admin password admin. Application Firefox. And above there a whole bunch of information about the computer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:21:10:06 &#8211; 00:21:25:05<br>Keith<br>So let&#8217;s break down what was in that stolen file. So first the system recon data. At the top. You&#8217;ll remember the malware collected a full inventory of the victim&#8217;s computer. It&#8217;s like an IT audit but with way more felony charges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:21:25:10 &#8211; 00:21:47:33<br>Keith<br>And here&#8217;s what the attacker was actually after the saved credentials I showed you in the original raw text, but I made it on a nice little table here that you can look at and admire the admin admin for google.com. So the attacker really didn&#8217;t need to crack anything. Though, keep in mind this was captured on any.run sandbox.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:21:47:33 &#8211; 00:22:01:51<br>Keith<br>So the weak credentials of admin slash admin meaning username admin password admin. The weak credentials are expected for this type of a test environment, so a real victim&#8217;s passwords hopefully may vary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:22:01:56 &#8211; 00:22:14:26<br>Keith<br>The attacker went through all that effort though. Phishing, JavaScript anti analysis. FTP to steal the password admin. Which is the first thing I try when I forget my own passwords.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:22:14:31 &#8211; 00:22:34:09<br>Keith<br>Firefox stores saved passwords in this logins.json, and without a master password on that, they&#8217;re readable by any process running as the user. So the only thing standing between your Firefox passwords and the Polish JavaScript file is absolutely nothing. So turn on your master password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:22:34:14 &#8211; 00:22:50:21<br>Keith<br>So here&#8217;s the timeline. The PCAP starts with normal windows background noise. DNS for things like microsoft.com. And then you see at 2:45:40 there&#8217;s DNS for google.com. And that&#8217;s probably a connectivity check by the script.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:22:50:26 &#8211; 00:23:07:54<br>Keith<br>At 2:45:46 the anti sandbox ip-api.com check happens and at 2:45:47 the FTP C2 resolves and the connection begins. At 2:45:48 the stolen data is already uploaded and its all done.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:23:07:59 &#8211; 00:23:36:32<br>Keith<br>The entire malicious activity about two seconds. The attacker did more damage in two seconds than most people do all day. Two seconds of network traffic. The days of incident response. The ROI is horrible. After the exfiltrtion, Windows telemetry continues like nothing happened. The credential theft we saw is one shot, steal, upload and done. But the malware also has persistence via scheduled tasks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:23:36:32 &#8211; 00:24:01:01<br>Keith<br>The tasks that we looked at earlier, and that happens every 15 minutes, and the dropped TTF payload that runs every 15 minutes. So there may be more stages we didn&#8217;t see in this short PCAP that was just run on a malware analysis sandbox, which eventually will end after a couple of minutes. It doesn&#8217;t stay on there for hours, so we may miss part of this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:24:01:06 &#8211; 00:24:08:55<br>Keith<br>And the malware is like a smash and grab. But the smash is a JavaScript file and the grab is your Firefox passwords.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:24:09:00 &#8211; 00:24:29:43<br>Keith<br>So your hunting checklist courtesy of this PCAP. DNS queries for FTP dot any domain from a non server workstation. Outbound FTP on port 21 from client machines IP-API queries with fields equals hosting. That&#8217;s usually a dead giveaway.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:24:29:48 &#8211; 00:24:38:48<br>Keith<br>FTP names matching PW underscore, then it&#8217;s a user, then it&#8217;s the host name, and then it&#8217;s a big time stamp dot html.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:24:38:52 &#8211; 00:25:00:40<br>Keith<br>We knew that that&#8217;s how this malware bundles up the credentials. The IOC&#8217;s come directly from this PCAP and the published any.run analysis that you can get online. And the hunting checklist is shorter than the malware file name, believe it or not. These IOCs are brought to you by the attackers decision to not use encrypted protocols.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:25:00:44 &#8211; 00:25:29:54<br>Keith<br>Let&#8217;s talk about detections. I wrote a script that generates notices for these four stages of this attack, and individually each notice could be a false alarm, but you need a good excuse for IP-API and FTP dot telewatte and FTP plain text passwords all hitting the same host. It&#8217;s just when all these things line up, the probability becomes much greater that you&#8217;re probably dealing with this malware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:25:29:59 &#8211; 00:25:36:42<br>Keith<br>Three detection points. The attacker left more footprints than a Daytona beach on spring break.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:25:36:47 &#8211; 00:26:07:58<br>Keith<br>This rule catches the anti sandbox IP-API.com call, which is that HTTP request we talked about earlier. The specific URI it&#8217;s looking for is that slash line slash question mark fields equals hosting. And it&#8217;s unique. Typically the malware, usually legitimate software does not query this URL. I mean it could, but this is usually a pretty good flag that something malicious trying to figure out if it&#8217;s on a hosting service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:26:08:03 &#8211; 00:26:19:46<br>Keith<br>And it says \u201cAm I in a data center?\u201d So the malware asked am I in a sandbox before stealing passwords, and that&#8217;s more situational awareness than most interns.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:26:19:51 &#8211; 00:26:32:00<br>Keith<br>Some additional rules. DNS for the C2 domain, the ftp.telewatte-pe.com, and the credential file name pattern of PW underscore star dot html.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:26:32:05 &#8211; 00:26:47:26<br>Keith<br>The store rule uses that regex to catch any FTP upload matching the naming convention. Even if the domain or the IP address changes. The malware has more lines of JavaScript obfuscation than we have lines of detection. But I like our odds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:26:47:31 &#8211; 00:26:54:34<br>Keith<br>Running the script against the PCAP generates three notices, each one for each detection rule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:26:54:39 &#8211; 00:27:13:52<br>Keith<br>The full script is in the scripts directory in this episode\u2019s directory, and you can get to it on the same table of that UnpackThePCAP.com that I pointed to earlier to get to the slides. It&#8217;s truly a free detection rule and no subscription required, but a subscribe would be appreciated!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:27:13:57 &#8211; 00:27:42:48<br>Keith<br>Here are the DuckDB queries to hunt for this campaign across your Zeek logs retroactively. You have the number one the FTP store commands with that HTML file names, which is the exfil pattern that we saw earlier. And we have number two, the IP-API.com HTTP request to that specific hosting URI that we discussed earlier that tries to be anti-sandbox.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:27:42:53 &#8211; 00:28:11:19<br>Keith<br>These queries work on any Zeek log directory just using this read_zeek function inside the DuckDB extension I pointed you to earlier. And the star star slash glob searches all subdirectories recursively, so you can point this at your entire Zeek log repository and just let it go and see what comes back, and then start doing the correlations like we did in this video, and try to figure out if it&#8217;s this malware strain or not.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:28:11:24 &#8211; 00:28:32:04<br>Keith<br>Just two DB queries. That&#8217;s all it took. The malware took more lines to obfuscate its variable names. The attacker&#8217;s entire kill chain fits in two SQL where clauses. The attacker built a multi-stage JavaScript dropper. I built a two line DB query. I got the better deal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:28:32:09 &#8211; 00:28:42:23<br>Keith<br>Blue team takeaway time. Takeaway number one. FTP from a non server machine in 2026 is almost always suspicious.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:28:42:27 &#8211; 00:29:05:45<br>Keith<br>FTP has been on its way out so not a lot of people use FTP anymore. You have SFTP, you have SCP and even SMB. Sure. Plaintext FTP from a Windows 10 desktop? Nope. FTP is from the era when sending your passwords in the clear was socially acceptable, like smoking in hospitals or using Internet Explorer 6.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:29:05:50 &#8211; 00:29:21:23<br>Keith<br>This campaign uses FTP because it&#8217;s simple to script in JavaScript. FTP traffic blends in with other outbound TCP traffic and some SOCs, they don&#8217;t monitor FTP traffic closely at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:29:21:27 &#8211; 00:29:36:27<br>Keith<br>And blue Team takeaway number two. I don&#8217;t even need a slide for this. Anti-aliasing checks. They&#8217;re a beacon. So the ip-api.com that we saw earlier with that specific URI that goes to fields equal hosting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:29:36:42 &#8211; 00:29:48:24<br>Keith<br>That&#8217;s likely malware behavior. So any client querying IP-API.com for hosting, proxy, mobile fields should be investigated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:29:48:29 &#8211; 00:30:09:05<br>Keith<br>Take away three, JavaScript files are executables, not documents. Windows script hosts. That&#8217;s a windows component that runs JavaScript files, and double clicking on a JavaScript file launches wscript.exe, which executes it no different than running an exe file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:30:09:10 &#8211; 00:30:19:51<br>Keith<br>Windows Script Host provides the ActiveX objects that this malware uses the wscript dot shell scripting dot filesystemobject, etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:30:19:56 &#8211; 00:30:26:46<br>Keith<br>Users think it&#8217;s a document. Windows treats it as an executable. The attacker thinks you for your confusion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:30:26:51 &#8211; 00:30:51:42<br>Keith<br>So some policy recommendations. Block JavaScript attachments at the email gateway. If users need JavaScript files, use a controlled process, maybe a zip with a password or a developer channel to pass that JavaScript around. Instead, monitor for wscript.exe and cscript.exe spawning from Office and email processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:30:51:47 &#8211; 00:31:19:50<br>Keith<br>Takeaway number four, a short PCAP can miss the bigger picture. We caught the credential theft here in about two seconds, meaning two seconds is all it took for the attack. But with our queries it was almost two seconds as well. A short PCAP may not show the full picture. There could be other stages, maybe 30 minutes out. Another stage ran that we didn&#8217;t see so we could have missed something.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:31:19:55 &#8211; 00:31:26:43<br>Keith<br>We caught the appetizer, but the main course was scheduled for every 15 minutes and just never showed up in the PCAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:31:26:47 &#8211; 00:31:37:09<br>Keith<br>Detection tip: even if the PCAP looks short, check the malware strings for persistence mechanism. Here we saw the scheduled task persistence mechanism being used.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:31:37:14 &#8211; 00:31:45:26<br>Keith<br>Takeaway five the attackers didn&#8217;t encrypt their own traffic. The attacker&#8217;s own FTP password was in plaintext in the PCAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:31:45:31 &#8211; 00:31:54:04<br>Keith<br>So that really random looking password that I described to you earlier was not exactly admin, but it was still sent in the clear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:31:54:09 &#8211; 00:32:01:50<br>Keith<br>The attacker stole passwords for a living, but didn&#8217;t bother to encrypt their own. And it was like a locksmith who leaves their own keys in the door.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:01:55 &#8211; 00:32:07:15<br>Keith<br>What this means for defenders. If you have network visibility, you can capture attacker credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:07:19 &#8211; 00:32:10:58<br>Keith<br>Consider flowing Zeek FTP logs into your SIEM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:11:03 &#8211; 00:32:17:09<br>Keith<br>The only encrypted thing in this entire attack was a TLS cert check that had nothing to do with the crime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:17:14 &#8211; 00:32:35:19<br>Keith<br>Based on the PCAP and published analysis, this campaign was simple but effective. No zero days, no buffer overflows, no fancy exploits, just a JavaScript file and human nature. The malware didn&#8217;t exploit vulnerability, it exploited the user. Much easier to find.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:35:24 &#8211; 00:32:59:04<br>Keith<br>The timeline tells the story. The first malicious packet to IP-API to the upload complete. That&#8217;s about three seconds, and that&#8217;s faster than most security tools can alert. You can have the best EDR, the best SIEM, the best SOC, but none of that helps if Linda in accounting double clicks a JavaScript file at 2:45 am.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:32:59:09 &#8211; 00:33:03:33<br>Keith<br>End user takeaways: block JavaScript attachments at the gateway.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:33:03:35 &#8211; 00:33:13:54<br>Keith<br>Alert on outbound FTP from workstations. Monitor for IP-API.com queries specifically looking for that hosting parameter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:33:13:59 &#8211; 00:33:33:23<br>Keith<br>Train your users that JavaScript files are executable code and for the love of God, don&#8217;t use admin as your actual password, though in this case it was any.run sandbox, so the week creds are to be expected. But the attacker worked harder for admin than the victim did to create it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:33:33:28 &#8211; 00:33:58:11<br>Keith<br>Three seconds of exfiltration to steal a password that takes zero seconds to guess. Admin admin. The password was so weak the malware should have been embarrassed to steal it. So last closing thought none of this required a zero day or nation state budget. Just a JavaScript file, a NameCheap FTP, and one tired user at 2 a.m.. That&#8217;s a threat model that keeps us up at night.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">00:33:58:16 &#8211; 00:34:02:18<br>Keith<br>If this was useful, please subscribe, like and share. We&#8217;ll see you on the next<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[144,436,140,91,24,65,435,4],"tags":[],"class_list":["post-3999","post","type-post","status-publish","format-standard","hentry","category-detection","category-duckdb","category-malware","category-open-source","category-pcaps","category-theft","category-unpackthepcap","category-zeek"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"drkeithjones\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"DrKeithJones.com - A cybersecurity researcher&#039;s journey.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com\" \/>\n\t\t<meta property=\"og:description\" content=\"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-30T20:11:46+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-30T20:11:50+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/keithjjones\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@keithjjones\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@keithjjones\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#blogposting\",\"name\":\"Polish \\u201cPowiadomienie\\u201d JS Campaign \\u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com\",\"headline\":\"Polish &#8220;Powiadomienie&#8221; JS Campaign \\u2014 Credential Theft via FTP Exfiltration\",\"author\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/author\\\/drkeithjones_iitpux\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#articleImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g\",\"width\":96,\"height\":96,\"caption\":\"drkeithjones\"},\"datePublished\":\"2026-07-30T16:11:46-04:00\",\"dateModified\":\"2026-07-30T16:11:50-04:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#webpage\"},\"articleSection\":\"Detection, DuckDB, Malware, Open Source, PCAPs, Theft, Unpack the PCAP, Zeek\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/drkeithjones.com\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/category\\\/zeek\\\/#listItem\",\"name\":\"Zeek\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/category\\\/zeek\\\/#listItem\",\"position\":2,\"name\":\"Zeek\",\"item\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/category\\\/zeek\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#listItem\",\"name\":\"Polish &#8220;Powiadomienie&#8221; JS Campaign \\u2014 Credential Theft via FTP Exfiltration\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#listItem\",\"position\":3,\"name\":\"Polish &#8220;Powiadomienie&#8221; JS Campaign \\u2014 Credential Theft via FTP Exfiltration\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/category\\\/zeek\\\/#listItem\",\"name\":\"Zeek\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/#person\",\"name\":\"drkeithjones\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g\",\"width\":96,\"height\":96,\"caption\":\"drkeithjones\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/author\\\/drkeithjones_iitpux\\\/#author\",\"url\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/author\\\/drkeithjones_iitpux\\\/\",\"name\":\"drkeithjones\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g\",\"width\":96,\"height\":96,\"caption\":\"drkeithjones\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#webpage\",\"url\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/\",\"name\":\"Polish \\u201cPowiadomienie\\u201d JS Campaign \\u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com\",\"description\":\"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \\u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \\u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \\u2014 breaking down\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/2026\\\/07\\\/30\\\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/author\\\/drkeithjones_iitpux\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/index.php\\\/author\\\/drkeithjones_iitpux\\\/#author\"},\"datePublished\":\"2026-07-30T16:11:46-04:00\",\"dateModified\":\"2026-07-30T16:11:50-04:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/#website\",\"url\":\"https:\\\/\\\/drkeithjones.com\\\/\",\"name\":\"DrKeithJones.com\",\"description\":\"A cybersecurity researcher's journey.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/drkeithjones.com\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com","description":"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down","canonical_url":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#blogposting","name":"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com","headline":"Polish &#8220;Powiadomienie&#8221; JS Campaign \u2014 Credential Theft via FTP Exfiltration","author":{"@id":"https:\/\/drkeithjones.com\/index.php\/author\/drkeithjones_iitpux\/#author"},"publisher":{"@id":"https:\/\/drkeithjones.com\/#person"},"image":{"@type":"ImageObject","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#articleImage","url":"https:\/\/secure.gravatar.com\/avatar\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g","width":96,"height":96,"caption":"drkeithjones"},"datePublished":"2026-07-30T16:11:46-04:00","dateModified":"2026-07-30T16:11:50-04:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#webpage"},"isPartOf":{"@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#webpage"},"articleSection":"Detection, DuckDB, Malware, Open Source, PCAPs, Theft, Unpack the PCAP, Zeek"},{"@type":"BreadcrumbList","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/drkeithjones.com#listItem","position":1,"name":"Home","item":"https:\/\/drkeithjones.com","nextItem":{"@type":"ListItem","@id":"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/#listItem","name":"Zeek"}},{"@type":"ListItem","@id":"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/#listItem","position":2,"name":"Zeek","item":"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/","nextItem":{"@type":"ListItem","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#listItem","name":"Polish &#8220;Powiadomienie&#8221; JS Campaign \u2014 Credential Theft via FTP Exfiltration"},"previousItem":{"@type":"ListItem","@id":"https:\/\/drkeithjones.com#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#listItem","position":3,"name":"Polish &#8220;Powiadomienie&#8221; JS Campaign \u2014 Credential Theft via FTP Exfiltration","previousItem":{"@type":"ListItem","@id":"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/#listItem","name":"Zeek"}}]},{"@type":"Person","@id":"https:\/\/drkeithjones.com\/#person","name":"drkeithjones","image":{"@type":"ImageObject","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g","width":96,"height":96,"caption":"drkeithjones"}},{"@type":"Person","@id":"https:\/\/drkeithjones.com\/index.php\/author\/drkeithjones_iitpux\/#author","url":"https:\/\/drkeithjones.com\/index.php\/author\/drkeithjones_iitpux\/","name":"drkeithjones","image":{"@type":"ImageObject","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/dee83de34730f3a340cb0cdf15ab1de7f04e96f129f78c426da03098df1912fb?s=96&d=retro&r=g","width":96,"height":96,"caption":"drkeithjones"}},{"@type":"WebPage","@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#webpage","url":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/","name":"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com","description":"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/drkeithjones.com\/#website"},"breadcrumb":{"@id":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/#breadcrumblist"},"author":{"@id":"https:\/\/drkeithjones.com\/index.php\/author\/drkeithjones_iitpux\/#author"},"creator":{"@id":"https:\/\/drkeithjones.com\/index.php\/author\/drkeithjones_iitpux\/#author"},"datePublished":"2026-07-30T16:11:46-04:00","dateModified":"2026-07-30T16:11:50-04:00"},{"@type":"WebSite","@id":"https:\/\/drkeithjones.com\/#website","url":"https:\/\/drkeithjones.com\/","name":"DrKeithJones.com","description":"A cybersecurity researcher's journey.","inLanguage":"en-US","publisher":{"@id":"https:\/\/drkeithjones.com\/#person"}}]},"og:locale":"en_US","og:site_name":"DrKeithJones.com - A cybersecurity researcher's journey.","og:type":"article","og:title":"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com","og:description":"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down","og:url":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/","og:image":"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg","og:image:secure_url":"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg","article:published_time":"2026-07-30T20:11:46+00:00","article:modified_time":"2026-07-30T20:11:50+00:00","article:publisher":"https:\/\/www.facebook.com\/keithjjones","twitter:card":"summary_large_image","twitter:site":"@keithjjones","twitter:title":"Polish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration - DrKeithJones.com","twitter:description":"A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` \u2014 rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap \u2014 ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join me as I walk through the malware sample and PCAP \u2014 breaking down","twitter:creator":"@keithjjones","twitter:image":"https:\/\/drkeithjones.com\/wp-content\/uploads\/2023\/02\/ecb.jpg"},"aioseo_meta_data":{"post_id":"3999","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-07-30 20:11:27","updated":"2026-07-30 20:11:51","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/drkeithjones.com\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/\" title=\"Zeek\">Zeek<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPolish \u201cPowiadomienie\u201d JS Campaign \u2014 Credential Theft via FTP Exfiltration\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/drkeithjones.com"},{"label":"Zeek","link":"https:\/\/drkeithjones.com\/index.php\/category\/zeek\/"},{"label":"Polish &#8220;Powiadomienie&#8221; JS Campaign \u2014 Credential Theft via FTP Exfiltration","link":"https:\/\/drkeithjones.com\/index.php\/2026\/07\/30\/polish-powiadomienie-js-campaign-credential-theft-via-ftp-exfiltration\/"}],"jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts\/3999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/comments?post=3999"}],"version-history":[{"count":0,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts\/3999\/revisions"}],"wp:attachment":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/media?parent=3999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/categories?post=3999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/tags?post=3999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}