MALICIOUS (1) campaign cataloged at 2026-10-20(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-10-omeraf¶
The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a local filesystem, suggesting the operator has to have some degree of control of the environment.
Abuse categories¶
abuses-pth
The package uses .pth files, sitecustomize or usercustomize modules to execute malicious code during Python startup, even without importing the package code manually.
basic_exfiltration
The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
exfiltration_cloud_tokens
Campaign uses exfiltration_cloud_tokens.
other
Campaign uses other.