HIGHLY_SUSPICIOUS (1) campaign cataloged at 2025-07-29(2).
- Packages that are likely malicious, but due to the obfuscation level, lack of time or clear indicators it's hard to say what exactly they do; the highest risk of false positives.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-07-telemaster¶
Obfuscated library that allows spanning a bot delivering local files to a Telegram channel. While it can be used in this legitimate use case of delivering logs to an administrator, the obfuscation of the code may suggest hidden intentions. The code does not run automatically and does not include any hardcoded Telegram credentials, so there is no clear threat directly here.
Abuse categories¶
obfuscation
Campaign uses obfuscation.
other
Campaign uses other.
webhook:telegram
A Telegram webhook is used to send collected data.