MalSync Teardown: From DLL Hijacking to PHP Malware for Windows

This PHP implant is a credential/cookie stealer designed for Windows hosts: it enumerates browser profiles (Chromium and Firefox), copies and decrypts cookies and login credentials (including decrypting Chrome's encrypted_key using an embedded/decoded executable), assembles and exfiltrates stolen data to hardcoded C2 endpoints, and contains functionality to retrieve Facebook/Instagram access tokens and session cookies for account takeover. The agent also supports remote tasks such as downloading or uploading files and executing arbitrary shell commands, making it suitable for broad account compromise and follow-on abuse.