Loading story…
Python maintainers and incident responders have highlighted a security risk in .pth path configuration files, which can execute arbitrary code during interpreter startup when a line begins with import followed by whitespace. A CPython issue raised concern over hidden .pth files, while DFIR reporting detailed how the behavior can be abused as a stealthy persistence mechanism that triggers whenever Python starts or imports modules, often from trusted locations such as site-packages or user package directories.
The technique has been tied to real-world intrusion activity: DFIR analysis cited Volexity’s reporting on exploitation of Palo Alto Networks GlobalProtect CVE-2024-3400, where attackers allegedly deployed a backdoor as /usr/lib/python3.6/site-packages/system.pth and protected it from deletion. Researchers warned that malicious .pth files may evade many default forensic and security workflows because they resemble benign package metadata, though file-creation telemetry and EDR process-chain monitoring can help detect suspicious Python-launched activity.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
A DFIR blog post analyzed how Python .pth files can be abused for stealthy persistence, including discussion of Volexity-reported malware tied to GlobalProtect CVE-2024-3400 and a lab demonstration showing code execution via malicious .pth files.
A CPython issue tracker discussion documented the security risk posed by hidden .pth files, noting they can be abused to execute code when Python starts while requiring user interaction to activate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk Enterprise Security released analytics to detect malicious Python package installations that execute attacker code during installation or persist through Python startup mechanisms. The coverage flags abuse of `setup.py`, `distutils`/`setuptools` command classes, `.pth` files, `sitecustomize.py`, `usercustomize.py`, and `PYTHONPATH`; these techniques can execute arbitrary code during package installation or whenever a user later starts Python. The detections were informed by TeamPCP's compromise of the `litellm` package, which used `.pth`-based persistence, and VIPERTUNNEL's abuse of Python site hooks. The endpoint analytics correlate Sysmon process-creation and file-creation events to identify `.pth` files created in `site-packages` or `dist-packages`, and correlate Sysmon Event IDs 1 and 13 to identify `PYTHONPATH` registry changes associated with `pip` and site-package activity. A malicious `PYTHONPATH` can redirect imports to attacker-controlled directories, analogous to PATH-search-order hijacking in which a malicious executable is resolved before the legitimate one. Security teams should enable the required Sysmon and CIM telemetry, investigate anomalous package-install activity and environment-variable changes, and tune for legitimate editable installs, namespace packages, developer workflows, and installer configuration changes.
Aug 28, 2026
Security researchers detailed a persistence technique that abuses Python’s `PYTHONPYCACHEPREFIX` environment variable to redirect `.pyc` bytecode into an attacker-controlled writable cache path and have that bytecode executed by applications that ship with bundled Python runtimes. The technique was demonstrated against **PgAdmin4**, where a malicious `__init__.pyc` for the `pgadmin` package executed within the trusted PgAdmin4 process context, giving attackers a way to maintain code execution without modifying the original application files. The research found the method worked on **PgAdmin4 v9.11.1** with **Python 3.13.9** and could be made more durable by using Python’s `PycInvalidationMode.UNCHECKED_HASH`, allowing malicious cache files to remain valid even if the corresponding `.py` source changes. Although **PgAdmin4 v9.11.2** and later disabled new bytecode writes through `PYTHONDONTWRITEBYTECODE`, the application still reads existing `.pyc` files, meaning pre-generated malicious bytecode can still be loaded; the researchers warned the issue is not unique to PgAdmin4 and may affect other software that launches bundled Python from user-controlled contexts.
Aug 6, 2026
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026