Yeah... the on-chain payload delivery is a clever evolution, it removes the static artifact entirely. In this case they used a similar approach but with a Vercel-hosted serverless endpoint as the loader instead of on-chain data. Same principle, nothing malicious exists in the repo itself, payload is fetched at runtime. The two-stage split (ephemeral loader vs persistent TCP C2) was the part I hadn't seen well-documented before.