28-07-2026 Sixteen strangers and a shared obfuscator: mapping the wool scene TLDR: What looked like 16 independent authors is one shared tool stack. Custom obfuscator helper variable names carry between accounts, four unrelated repos target the same obscure mini program, every Unicom bot pulls device IDs from the same Gitee file, and the git-history scrub recipe is published as a how-to on one of the operators’ own blogs. These operators know GitHub is dangerous. One of them publishes a how to on wiping your commit history, and the scene treats the scrub as routine (we saw it in multiple places). It doesn’t save them: trying to hide your tracks is itself a trace, and they guard the obvious surface (repo contents, secrets) while leaving the structural one (fork graphs, delete diffs) wide open. They defend the page, not the graph. The scene’s shared JS deobfuscator, smallfawn/decode_action , has 1,300+ forks. Every fork is a public git history of every script that operator ever needed decoded, and the fork list itself is a directory of who’s in the scene. Nobody meant it to be a signal. It is one anyway, and it’s how I found actors the toolchain fingerprint missed. Sixteen actors is what I mapped, not a complete census. Handle -> real person is always (inferred) . I mapped operators and infrastructure, not identities. Terms in this post If you landed here mid-series, the hub post has the whole picture and the full glossary. The load-bearing ones: OSINT : mapping a scene from public artifacts only, not from touching anything live. IOC : indicator of compromise. Any specific thing (domain, key, filename, magic prefix, handle) unique enough to pivot on. orphan-branch scrub : git checkout --orphan ... && push -f . Rewrites a repo’s whole history to erase a leaked secret. Also very obviously the thing that happened. device-ID pool : a shared list of spoofed device fingerprints. Every bot pulls from the same file, so every user of these scripts presents the same handful of “phones” to fraud detection. ev2 : the sealed payload format from part 2 . Opens with the 12-char magic |(LTm_R7mUd@ . That magic is one of my pivots. What a shared cipher actually proves I already knew this was a scene, and not just a few kids messing around. The first post laid the supply chain out end to end: operators writing the scripts, wyourname renting DRM over the top, shared plumbing underneath, a marketplace stitching it all together. What I didn’t have yet was hard, code-level proof of who was tied to who . “This looks like a supply chain” is a structural hunch. I wanted a fingerprint, and proof. Here’s where the fingerprint turned up. The 985Ming/qlk repo has two hand rolled obfuscators. Not off the shelf, not jsjiami.com.v7 , not sojson , just private helpers with names like custom_subtract and xor_b85 . When youre rolling your own crypto you get to name your own helpers, and names like those don’t turn up in a normal Python codebase by accident. Obiligtory “Don’t roll your own crypto”. Then they turned up in xxwppp/2025 . 康师傅瓶盖1.3.py uses the same subtract cipher. 王老吉签到1.0.py uses the same b85+XOR. Different account, different marketplace watermark, same private crypto. I want to be careful about what that does and doesn’t buy me, because this is exactly the spot where this kind of work fools people. It is not proof that qlk and xxwppp are the same hands, and it isn’t even proof of who wrote either script. Remember what xxwppp does for a living: they take other people’s plaintext and run it through their own obfuscation before reselling it. In a scene that sells obfuscation as a service, the toolchain is the most-shared thing in it, not the least. A matching cipher might mean “same author”, or it might just mean “both scripts went through the same laudnromat”, and I can’t split those apart from the cipher alone. What it does buy me is a signal, and that turns out to be the thing worth having. Off the shelf obfuscators ( jsjiami.com.v7 , sojson ) mark nothing, everyone on earth runs those. A hand rolled custom_subtract that shows up in no normal Python codebase is the opposite: it only ever circulates inside this circle, so wherever it turns up, that repo is inside the circle too. It doesn’t tell me who is who. It tells me these accounts are all pulling from one shared tool stack, which is the entire idea. Everything past this point is me pulling on that thread. And the two moves that did most of the work from here are both opsec own-goals: the traces these operators left while trying to cover them , and the GitHub surfaces they never thought to hide. They know the platform is dangerous. One of them, as you’ll soon see, publishes a guide to scrubbing your repo. But the risk they’re defending against is “someone reads my code”, not “the platform’s own structure is a ledger”. They defend the page. They don’t defend the graph. The shared toolchain Once you know to look for it, the fingerprints pile up fast: The custom obfuscators. cust...