ZiChatBot PyPI supply-chain malware delivery
Malware Activity
Summary
Hide ▲
Show ▼
A PyPI supply-chain attack used three packages to quietly deliver ZiChatBot, creating a cross-platform malware risk for Windows and Linux installs. The packages were uploaded between July 16 and 22, 2025 and later removed from the repository. On Windows, the loader writes terminate.dll and adds a Registry auto-run entry; on Linux, it drops terminate.so and sets crontab persistence. The malware uses Zulip REST APIs for C2, reducing reliance on a traditional command-and-control server.
Related Happenings
GlassWorm v2 cloned VS Code extension loaders
Malware Activity
H score30
First: 27.04.2026 14:23
Last: 27.04.2026 14:23
Sources 1
About this happening:
The GlassWorm v2 malware activity now uses cloned VS Code extensions on Open VSX to deliver payloads that steal credentials, deploy a RAT, and spread across multip...
GlassWorm v2 cloned VS Code extension loaders
Malware ActivityAbout this happening: The GlassWorm v2 malware activity now uses cloned VS Code extensions on Open VSX to deliver payloads that steal credentials, deploy a RAT, and spread across multip...
Telnyx package WAV-hidden credential-stealing malware
Malware Activity
H score29
First: 27.03.2026 23:13
Last: 27.03.2026 23:13
Sources 1
About this happening:
The malicious Telnyx package releases 4.87.1 and 4.87.2 delivered credential-stealing malware to imported systems, putting Linux, macOS, and Windows environmen...
Telnyx package WAV-hidden credential-stealing malware
Malware ActivityAbout this happening: The malicious Telnyx package releases 4.87.1 and 4.87.2 delivered credential-stealing malware to imported systems, putting Linux, macOS, and Windows environmen...
Telnyx Python package hit by data theft breach
Incident
H score42
First: 27.03.2026 18:53
Last: 27.03.2026 18:53
Sources 1
About this happening:
The telnyx Python package was compromised on PyPI with 4.87.1 and 4.87.2, exposing downstream importers to credential theft and data exfiltration. The mali...
Telnyx Python package hit by data theft breach
IncidentAbout this happening: The telnyx Python package was compromised on PyPI with 4.87.1 and 4.87.2, exposing downstream importers to credential theft and data exfiltration. The mali...
Telnyx malicious payload stealer delivered via WAV files
Malware Activity
H score30
First: 27.03.2026 18:53
Last: 27.03.2026 18:53
Sources 1
About this happening:
TeamPCP pushed a malicious telnyx package payload that turns package import into credential harvesting and encrypted exfiltration across Windows, Linux, and macO...
Telnyx malicious payload stealer delivered via WAV files
Malware ActivityAbout this happening: TeamPCP pushed a malicious telnyx package payload that turns package import into credential harvesting and encrypted exfiltration across Windows, Linux, and macO...
Lazarus Group graphalgo recruitment-themed package campaign
Campaign
H score38
First: 12.02.2026 18:55
Last: 12.02.2026 18:55
Sources 1
About this happening:
The North Korea-linked Lazarus Group is running graphalgo, an active fake recruitment-themed package campaign that is targeting developers through npm and PyPI...
Lazarus Group graphalgo recruitment-themed package campaign
CampaignAbout this happening: The North Korea-linked Lazarus Group is running graphalgo, an active fake recruitment-themed package campaign that is targeting developers through npm and PyPI...
Timeline
-
07.05.2026 12:20 2 articles · 2mo ago
Researchers disclose PyPI packages delivering ZiChatBot
Initial DisclosureCybersecurity researchers identify three PyPI packages, uuid32-utils, colorinal, and termncolor, that covertly deliver the ZiChatBot malware family on Windows and Linux. The malicious loaders drop terminate.dll or terminate.so, establish Windows Registry auto-run or crontab persistence, and use Zulip REST APIs as C2 instead of a dedicated command-and-control server; Kaspersky also says the dropper is 64% similar to tooling associated with OceanLotus (APT32).
Show sources
- PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux — thehackernews.com — 07.05.2026 12:20
- PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux — thehackernews.com — 07.05.2026 12:20