MALICIOUS (1) campaign cataloged at 2026-09-24(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-09-prosocks

The package automatically joins the machine to a proxy network. Depending on the version, it can happen during the package installation or when importing the module.

Abuse categories

other

Campaign uses other.

peristence_autorun

Campaign uses peristence_autorun.

persistence

Campaign uses persistence.

IoCs & related URLs

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

• kalnetz.store

Packages in the campaign

campaign:2026-09-prosocks

• prosocks