Skip to content

MALICIOUS (1) campaign cataloged at 2026-03-02(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-02-amigapythonupdater

During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well as starts a job listening for commands to execute. Likely dependency confusion attempts

Abuse categories

dependency-confusion

An attempt to exploit dependency confusion

exfiltration_env_variables

Campaign uses exfiltration_env_variables.

exfiltration_generic

Campaign uses exfiltration_generic.

remote_commands

The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • 77.91.65.24

Packages in the campaign

campaign:2026-02-amigapythonupdater