GitHub used as C2, new Cloudflare exfiltration domain found, linked to April 22 Checkmarx KICS compromise via Dependabot.
Spy Mode questions were also an issue, ranging from 'what's your favorite Pokémon?' to improv scenarios with your stranger, ...