CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

ZiChatBot malware delivered via compromised PyPI packages leveraging Zulip APIs as C2

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Three malicious Python packages uploaded to PyPI between July 16–22, 2025 delivered a previously undocumented malware family, ZiChatBot, on Windows and Linux systems using Zulip REST APIs as a covert command-and-control channel. The attack bypassed traditional C2 infrastructure by abusing public chat platform APIs and exhibited code similarities to a dropper previously attributed to the OceanLotus (APT32) group, suggesting expansion of the actor’s supply chain tactics.

Timeline

  1. 07.05.2026 12:20 1 articles · 1h ago

    ZiChatBot malware delivered via compromised PyPI packages using Zulip APIs as C2

    Three malicious Python packages uploaded to PyPI between July 16–22, 2025 delivered ZiChatBot malware on Windows and Linux systems. The malware abuses Zulip REST APIs for command-and-control, writes a DLL or shared object dropper to disk, establishes persistence via Registry or crontab, and executes shellcode received from the C2. Code similarity to a known OceanLotus dropper suggests possible attribution.

    Show sources
    Open in new tab

Information Snippets