Skip to content

MALICIOUS (1) campaign cataloged at 2026-02-28(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-02-ctf-toolkit

The package states to contain a modified curl library to allow low-level request modifications. However, there is also undisclosed malicious behavior:

  1. The package installs a .pth file directly in the site-packages directory, effectively running a special code on each Python usage.
  2. This code performs "TLS context warm-up" by contacting a URL (Github) in the background, in a separate process; this is suspicious on its own as it's unclear how a separate process can warm up further requests in the main process, but...
  3. ...besides the URL given in the code above, the library always contacts a hardcoded URL, identifying itself as a VPN client.

Additionally, there is no source code of the modified library anywhere, and the related Github hosting the package code account is 1-day old.

Abuse categories

basic_exfiltration

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://vpnico-1318014164.cos.ap-singapore.myqcloud.com/ico.bmp

  • vpnico-1318014164.cos.ap-singapore.myqcloud.com

Packages in the campaign

campaign:2026-02-ctf-toolkit