Malicious code in aitextutils-py (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772) This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-aitextkit-py Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - persistence - infostealer - exfiltration-browser-data - rat - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
AI Analysis
Technical Summary
The aitextutils-py package versions 0.1.0 and 0.1.1 include malicious code that executes a remote dependency which downloads and runs a heavily obfuscated final-stage payload. This payload is hosted on a domain with a suspicious corporate website facade. The malware establishes persistence mechanisms such as a systemd service named "anymeetly-cameradriver." It functions as an infostealer, exfiltrating browser data and includes remote access trojan (RAT) capabilities with limited remote command execution.
Potential Impact
Infected systems may have sensitive browser data exfiltrated and be subject to remote command execution by attackers. The persistence mechanism allows the malware to survive reboots, increasing the risk of prolonged compromise. The malicious package poses a direct threat to confidentiality and system integrity.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should immediately remove versions 0.1.0 and 0.1.1 of aitextutils-py from their environments. Avoid installing this package and audit systems for the presence of the "anymeetly-cameradriver" systemd service or other indicators of compromise. Consider blocking the suspicious domain at the network level. Monitor for unusual systemd services and network activity related to this threat.
Malicious code in aitextutils-py (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (59b5d893cd227654dae3bd7964e54ba20c99963660993e4239f34bba0d50b772) This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-aitextkit-py Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - persistence - infostealer - exfiltration-browser-data - rat - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The aitextutils-py package versions 0.1.0 and 0.1.1 include malicious code that executes a remote dependency which downloads and runs a heavily obfuscated final-stage payload. This payload is hosted on a domain with a suspicious corporate website facade. The malware establishes persistence mechanisms such as a systemd service named "anymeetly-cameradriver." It functions as an infostealer, exfiltrating browser data and includes remote access trojan (RAT) capabilities with limited remote command execution.
Potential Impact
Infected systems may have sensitive browser data exfiltrated and be subject to remote command execution by attackers. The persistence mechanism allows the malware to survive reboots, increasing the risk of prolonged compromise. The malicious package poses a direct threat to confidentiality and system integrity.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should immediately remove versions 0.1.0 and 0.1.1 of aitextutils-py from their environments. Avoid installing this package and audit systems for the presence of the "anymeetly-cameradriver" systemd service or other indicators of compromise. Consider blocking the suspicious domain at the network level. Monitor for unusual systemd services and network activity related to this threat.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16131
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6aa47ea655bf5e2cf5855ed4
Added to database: 09/11/2026, 22:20:22 UTC
Last enriched: 09/11/2026, 23:05:52 UTC
Last updated: 09/12/2026, 01:01:23 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.