Loading story…
A typosquatted PyPI package, sympy-dev, impersonated the SymPy mathematics library and delivered a staged Linux payload through backdoored polynomial-code paths. Versions 1.2.3 through 1.2.6 fetched remote JSON configuration and ELF binaries from 63.250.56.54 and 185.167.99.46, then used memfd_create and /proc/self/fd/<fd> to execute payloads from memory without a conventional on-disk executable. Recovered second-stage payloads were UPX-packed XMRig miners communicating over Stratum TLS, though the loader could run arbitrary code with the Python process's privileges.
The campaign illustrates a broader Linux evasion pattern in which attackers execute ELF binaries, scripts, or kernel modules through anonymous memory-backed descriptors, deleted files, or unnamed temporary files. Related techniques include combining O_TMPFILE with execveat(AT_EMPTY_PATH) to run an ELF from an unnamed file. Defenders should prioritize behavioral telemetry and correlations—including memfd_create, execution through /proc/self/fd, interpreter process lineage, self-deletion, and init_module or finit_module calls—rather than relying solely on filesystem artifacts; Elastic Defend 9.4.0 adds relevant telemetry on supported Linux kernels.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Four malicious releases of the typosquatting sympy-dev package, versions 1.2.3 through 1.2.6, were published under the maintainer name Nanit. The package copied SymPy branding, surpassed 1,000 downloads on its first day, and embedded backdoor logic in SymPy polynomial code paths.
A post shared by digicat highlighted execution of Linux ELF binaries from an unnamed O_TMPFILE temporary file using execveat with AT_EMPTY_PATH, avoiding a conventional executable filesystem path.
Elastic Security 9.4.0 added Elastic Defend process-event visibility for memfd_create on supported Linux systems and records init_module and finit_module kernel-module loads as load_module events. The telemetry supports behavioral detection of descriptor-backed execution and in-memory module loading.
Socket reported that sympy-dev remained available on PyPI and petitioned the PyPI security team to remove the malicious package and suspend the associated publisher account.
Analysis found that sympy-dev retrieved configuration and ELF payloads from actor-controlled infrastructure and executed the payload through memfd_create and /proc/self/fd. Recovered UPX-packed second-stage binaries were identified as XMRig cryptominers, while version 1.2.6 added a second execution trigger using separate infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourceelastic.co
Open sourcetrendmicro.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a Python supply-chain attack on PyPI involving **`sympy-dev`**, a typosquatted package designed to impersonate the widely used **SymPy** symbolic mathematics library. The malicious listing copied SymPy’s description and branding and presented itself as a plausible “development” variant, leading to rapid uptake (reported at ~1,000–1,100+ downloads shortly after publication), increasing the likelihood of exposure in developer workstations and CI environments. Analysis indicates the package’s malicious logic is **selectively triggered** when certain polynomial routines are executed (e.g., Groebner-basis related functions), reducing the chance of immediate detection. When triggered, the backdoored code retrieves a remote JSON configuration, downloads a threat actor-controlled Linux **ELF** payload, and executes it **in-memory** using `memfd_create` and `/proc/self/fd` to minimize on-disk artifacts; reporting also identified infrastructure including `63.250.56[.]54`. The payload chain ultimately deploys **XMRig**-based cryptomining on Linux hosts, using techniques previously observed in cryptojacking activity such as **FritzFrog** and **Mimo**.
Jun 29, 2026
Researchers reported a covert Linux cryptomining campaign that gained access through a trusted third-party connection, escalated privileges to root, and then abused Pluggable Authentication Modules (PAM) to move into low-privileged accounts without passwords. The operators reportedly used `pam_rootok` with `su`, disabled or suppressed logging, altered authentication records, and planted redundant cron-based persistence across less-monitored user accounts to preserve access and complicate remediation. Group-IB linked the activity to the **V25 Generation 26** campaign family. The payload was described as a heavily modified, self-unlinking **XMRig 6.25.0** implant that ran from memory, used `/tmp/.lock` as a mutex, and spoofed process names such as `ssh` to evade detection. Researchers said the miner optimized execution with CPU-aware worker spawning, MSR interaction, and Huge Pages, while disguising Stratum mining traffic with a fake **Java Agent** user agent string to blend into normal network activity. Published indicators included the domain `unable[.]download`, campaign identifier `My-V25-GEN-26`, and multiple malware hashes tied to the implant.
Aug 11, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026