Malicious code in aiprepkit (PyPI)

Source: kam193 7a5376398cb81f79bf581819bf1f7fad54a6e3feaaa7ded6d3b418d4562c47d5 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while others like aichannel provide fake functionality and...

Malicious code in rbx1325382 (PyPI)

Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-rbx1325 Reasons based on the campaign: -...

Malicious code in rbx1325 (PyPI)

Source: kam193 7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-rbx1325 Reasons based on the campaign: -...

Malicious code in fernetpy (PyPI)

Source: kam193 ccbbcfd921dcefb2809ba41756181682f7a04f1a9f701adcf0c37c9889d87a98 If imported, the module starts a multi-stage infostealer, exfiltrating browser data as well as crypto wallets, and also attempts to monitor clipboard looking for crypto wallets addresses --- Category: MALICIOUS - The...