MalwarePublished 28 Jun 2026

fsociety-tools (PyPI) · Malicious Code

Affects fsociety-toolsSource GCVE Database

Malicious package : remove fsociety-tools and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:34 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6558

What to do

Remove fsociety-tools from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIfsociety-tools	Affected =1.0.0 =1.0.1 =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fsociety-tools package on PyPI (versions 1.0.0, 1.0.1, and 1.0.2) contains malicious code that acts as a dropper for a Windows executable infostealer named NBSteal. Upon import, the package decodes and decrypts an embedded executable, writes it to the temporary directory, and silently executes it without user awareness. The malware targets data exfiltration from browsers, Telegram, Discord, Roblox, and other platforms, stealing credentials and sensitive information. The package disguises this behavior behind a fake security tool facade and obfuscates the payload to evade detection.

Impact

Successful import or execution of the fsociety-tools package results in silent deployment and execution of an infostealer malware on Windows systems. This malware can exfiltrate sensitive user data including browser information, credentials, and data from Telegram, Discord, Roblox, and other targeted platforms. This leads to potential compromise of user accounts and privacy breaches. The malicious behavior occurs immediately upon import or running the package’s console script, without user consent or awareness.

Defensive guidance

Users and organizations should avoid installing or importing this package, especially versions 1.0.0, 1.0.1, and 1.0.2. Remove any existing installations of fsociety-tools from environments. Employ software supply chain security best practices such as verifying package provenance and using trusted sources. Monitor for any suspicious activity related to credential theft or data exfiltration on affected systems.

Summary

The fsociety-tools PyPI package versions 1.0.0 through 1.0.2 include an import-time malicious dropper. The __init__.py module loads tokens.py, which instantiates a TokenManager that reconstructs an embedded Windows PE executable by concatenating multiple base64-encoded chunks, XOR decrypting with key 66, and writing the result to %TEMP%\fsociety.tmp. It then launches this executable with no visible window. The embedded payload, internally named NBSteal, functions as an infostealer targeting browsers, Telegram, Discord, Roblox, and other gaming platforms to exfiltrate credentials and data. The package’s apparent purpose as a penetration testing utility is a decoy to mask the malicious activity. The use of obfuscation, hidden execution, and decoy APIs confirms the package’s malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:34 UTC

Technical details

References

Community reviews