Threats Tagged 'mal-2026-14388'

A malicious PyPI package named 'cryptgraphy' impersonates legitimate cryptography and AWS-related packages using typosquatting and falsified metadata. Upon installation, it executes a custom install script that delays for five minutes before downloading and running an ELF binary from an unrelated external server. The binary attempts to establish persistence, potentially via systemd services, and is associated with malicious activities such as cryptocurrency mining and network propagation. The package itself contains only stub functions, with the real malicious behavior occurring during installation. This campaign exhibits clear malicious intent and anti-forensic techniques.