Telnyx Python SDK Compromised to Deliver Credential-Stealing Malware

A supply chain attack affecting the telnyx Python package on PyPI has been identified. Malicious versions 4.87.1 and 4.87.2 contained embedded credential-harvesting malware. The attack employs a three-stage runtime chain on Linux/macOS using audio steganography for delivery, in-memory execution of a data harvester, and encrypted exfiltration. On Windows, it drops a persistent binary in the Startup folder. The malware uses sophisticated techniques including fileless execution, hybrid encryption, and anti-forensics measures. The threat actor, TeamPCP, demonstrates high operational security and cryptographic awareness. Developers are advised to audit environments, rotate credentials, and check for indicators of compromise.

• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware DistributionCampaign2026-09-22
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malwareCampaign2026-09-17
• TerminalFix campaign deploys a reverse tunnel through multistage intrusionMalware2026-08-29