Loading story…
Researchers reported a software supply chain attack on PyPI in which malicious wheel packages posing as Python libraries delivered a newly identified malware family, ZiChatBot. The campaign, which reportedly began in July 2025, used three projects—uuid32-utils, colorinal, and termncolor—with termncolor serving as a benign-looking dependency wrapper to conceal the malicious colorinal package. The malware targeted both Windows and Linux, established persistence, and was removed from PyPI after disclosure.
ZiChatBot stood out for using Zulip public team chat REST APIs instead of conventional command-and-control servers to retrieve shellcode for execution. Investigators said the operator registered a Zulip organization named "helper," which has since been deactivated, and found code-level similarities between the dropper and malware previously linked to OceanLotus, indicating the campaign may be connected to that threat actor. Although no confirmed infections were publicly observed at the time of reporting, the operation was described as a deliberate global PyPI ecosystem abuse campaign that extends suspected OceanLotus tradecraft beyond phishing.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Three Python packages tied to the ZiChatBot campaign — uuid32-utils, colorinal, and termncolor — were uploaded to PyPI between July 16 and 22, 2025. The first two carried malicious payloads, while termncolor appeared benign but pulled in colorinal as a dependency.
The malware family dubbed ZiChatBot used Zulip public team chat REST APIs instead of traditional command-and-control infrastructure to receive shellcode for execution. The operator registered a Zulip organization named "helper" to support this activity before it was later deactivated.
The campaign began in July 2025 with malicious Python wheel packages uploaded to PyPI that masqueraded as legitimate libraries. The operation used the projects uuid32-utils, colorinal, and termncolor, with termncolor serving as a benign-looking dependency wrapper for the malicious package.
Following disclosure, the malicious packages were removed from PyPI and the Zulip organization used by the attackers was deactivated. At the time of reporting, no infections had been observed in telemetry or public reporting.
Kaspersky researchers analyzed the dropper and found notable similarities to malware previously associated with OceanLotus, leading to a suspected attribution. They also assessed the operation as a carefully planned global PyPI supply chain attack affecting both Windows and Linux targets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply-chain** threats in public package registries where attacker-controlled libraries masquerade as legitimate utilities but install **Windows infostealers**. On NPM, a package named **`duer-js`** (publisher `luizaearlyx`) posed as a console visibility tool and delivered a multi-stage stealer self-identified as **Bada Stealer**; analysis attributed to **JFrog Security Research** described heavy obfuscation, persistence that can survive simple uninstall attempts, and follow-on payload delivery targeting **Discord** by hijacking the desktop client’s startup/injection path to continuously steal data when Discord runs. Separately, Safety’s research team documented **“ExtraZip”**, a campaign of **14 trojanized PyPI packages** impersonating ZIP utilities or mail-sending libraries that deploy a staged infostealer focused on **Telegram Desktop session files**, exfiltrating them via an attacker-controlled **Telegram bot**. The report described **32 layers of obfuscation** and provided an inventory of package names (e.g., `extrazip`, `minizip`, `ziphash`, and multiple `smt*lib` lookalikes) and a timeline of publishing activity across late 2025 through early 2026, indicating sustained, iterative attempts to seed malicious dependencies into developer environments.
Jun 29, 2026
Security researchers reported a supply-chain campaign targeting developers by impersonating legitimate AI-related tooling and luring victims into installing malware. A malicious PyPI package, `grokwrapper`, posed as an unofficial API wrapper for xAI’s Grok and used a common “benign-first, malicious-later” publishing pattern: an initial clean release was followed by a weaponized update intended to evade registry and scanner scrutiny. Once installed, the package was described as downloading and executing a second-stage payload, establishing persistence via Windows Registry changes, and maintaining access using **DLL sideloading** with a legitimate Microsoft binary (`wkspbroker.exe`), with targeting described as focused on developers outside CIS countries and consistent with tradecraft associated with **DPRK-linked** activity (including references to *Operation DreamJob* expansion beyond prior sectors). Separately, a maintainer documented abuse of a forked GitHub repository to distribute malware by converting the project’s README into a fake Windows “installer” landing page and embedding a ZIP payload directly in the source tree (rather than using GitHub Releases or a package manager). The attacker then rewired “Download” links to the embedded archive, mirrored the content via GitHub Pages, and reused the original project’s topics/metadata to drive **SEO hijacking**, increasing the chance that searches for enterprise AI integration terms would land on the malicious fork while the original author’s name appeared as a contributor due to inherited commit history. Together, the incidents highlight active abuse of trusted developer ecosystems (*PyPI* and *GitHub*) to deliver Windows malware through social engineering and dependency/asset trust assumptions.
Jul 12, 2026
Security researchers reported multiple **developer supply-chain** threats abusing trusted ecosystems to steal data or deliver malware. In Microsoft’s **VS Code Marketplace**, two AI-themed extensions—**ChatGPT – 中文版** (publisher *WhenSunset*, ~1.34M installs) and **ChatMoss (CodeMoss)** (publisher *zhukunpeng*, ~150K installs)—were found exfiltrating developer data to **China-based servers** without disclosure or consent. Koi Security attributed the activity to a campaign dubbed **“MaliciousCorgi,”** noting shared code and common backend infrastructure; the extensions reportedly monitor files opened in VS Code and transmit full contents (Base64-encoded), including subsequent changes. Separately, malicious **PyPI** packages **spellcheckerpy** and **spellcheckpy** impersonated the legitimate *pyspellchecker* project and embedded a Base64-encoded downloader inside a seemingly legitimate Basque dictionary resource (`resources/eu.json.gz`). Aikido reported the attacker first published “dormant” versions (payload present but not executed), then enabled execution in **spellcheckpy v1.2.0** by adding an obfuscated trigger that runs on import/initialization (e.g., when importing `SpellChecker`), ultimately downloading a **full-featured Python RAT**. Together, the incidents reinforce the risk of installing unvetted extensions and packages, even when they appear functional and reference legitimate upstream repos.
Jun 29, 2026