The aitextkit-py package versions 0.1.0 and 0.1.1 include hidden code that downloads a heavily obfuscated final-stage payload from a remote domain. This payload establishes persistence on the infected system by creating a systemd service named "anymeetly-cameradriver". The malware functions as an infostealer and RAT, capable of exfiltrating browser data and executing a limited set of remote commands. The campaign is identified as malicious with clear intent to steal information and maintain long-term access.

Infection leads to unauthorized persistence on the victim system, data theft including browser data exfiltration, and remote command execution capabilities. This compromises confidentiality and potentially integrity of the affected systems. The presence of a RAT allows attackers to control the system remotely, increasing the risk of further malicious activities.

No official patch or remediation is indicated. Users should immediately uninstall versions 0.1.0 and 0.1.1 of aitextkit-py. Avoid installing this package from PyPI and monitor for any unauthorized systemd services named "anymeetly-cameradriver". Conduct thorough system scans to detect and remove any remnants of the malware. Since this is a malicious package, the best mitigation is to avoid use and remove any installations.