MALICIOUS (1) campaign cataloged at 2026-09-22(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-09-auclean¶
During installation, the package executes an embedded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to exfiltrate collected information.
The package seems to be targeting the infrastructure of an AI audio competition https://dacon.io/competitions/official/236749
Abuse categories¶
exfiltration_cloud_tokens
Campaign uses exfiltration_cloud_tokens.
exfiltration_credentials
The package attempts to steal credentials, like passwords or API keys.
files_exfiltration
Campaign uses files_exfiltration.
malware
Package contains or installs known malware.
network-scan
Campaign uses network-scan.
override_install
The package overrides the install command in setup.py to execute malicious code during installation.
targetted-attack
Campaign uses targetted-attack.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
auclean-cdn.alcoholpepsi.workers.dev