From Gamifly to AjunaVerse and AlchemyMVP: Parallel Weaponization of a Shared Poker Repository Lineage

“The branches diverged; the payload did not.” Executive Summary This report analyzes two GitHub repositories discovered through follow-on hunting after ThreatProphet’s investigation of the Interexy-branded Gamifly lure: hxxps://github[.]com/LimitBreak-Solutions/AjunaVerse hxxps://github[.]com/AlchemyGlobal/AlchemyMVP The repositories were not directly delivered to the investigator during a recruitment interaction. They were identified by pivoting on Git commits, repository structure, poker-game artifacts, VS Code execution patterns, and malware-loader code preserved in the Gamifly lineage. Both were acquired as forensic Git mirrors on June 9, 2026. ...

June 9, 2026 · ThreatProphet

Interexy-Branded Gamifly Repositories: Evolution of the BetPoker Loader into a Vercel-Gated Node.js Tasking Implant

“The game stayed the same; only the organization name, gate, and dealer address changed.” Executive Summary This report analyzes an Interexy-branded fake developer recruitment operation that delivered a GitHub repository named Gamifly during a remote interview workflow. The engagement began with a LinkedIn job offer, moved to Calendly for interview scheduling, and culminated in a repository link shared during the call. A subsequent GitHub search identified a second repository under a slightly different organization name: ...

June 9, 2026 · ThreatProphet