MALICIOUS (1) campaign cataloged at 2026-10-16(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-10-fromthehotel-poems¶
One of the provided functions hides executing remote code from a newly created domain. During analysis, the remote code did not contain any malicious action. The description and other endpoints clearly suggest it's an attempt to exploit LLM agent like Muse. In one of the hosted instructions, the agent is instructed to download a self-hosted package depending on published code and trigger the code execution action.
Abuse categories¶
action-hidden-in-lib-usage
The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).
llm-threat
Malicious activity is designed against large language models, like e.g. prompt injection.
remote_script
Downloads and executes a remote malicious script.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://login.fromthehotel.com/api/poems/code -
hxxps://login.fromthehotel.com/api/art/downloads/art_fromthehotel-0.1.0-py3-none-any.whl -
login.fromthehotel.com -
hxxps://login.fromthehotel.com/muse