Threats tagged 'mal-2026-16264'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (46b706e618e75dd4f864a55a33a06cfa98c890d310735b1dea71ad86fe299fe6) The package ships a module (e.py) that prompts for administrator elevation via UAC, archives the contents of %LOCALAPPDATA%\logs with shutil.make_archive, and POSTs the resulting zip to a hardcoded attacker-controlled endpoint at https://sparkling-pine-f202.stilluer-sweden.workers.dev/ using requests.post. The %LOCALAPPDATA%\logs tree commonly contains Discord, browser, and game-tool artifacts including session data. The package's PyPI summary ("Safe bug reporter for sending local logs via Cloudflare Workers") and identifiers such as aiosendletter_logs are cover-story framing for bulk exfiltration of installer-owned data. Separately, pyproject.toml declares the Python stdlib name "ctypes" as an unpinned PyPI runtime dependency, causing pip to resolve and install whatever package currently occupies that registry name and execute its lifecycle code on the installer's machine — a dependency-confusion install-time code path in addition to the primary stealer payload. ## Source: kam193 (4e81e3b63bbe719f6d0bdd42930bb2f3235b8e41cbacf449743bb7dca67c9f08) Package hides code to exfiltrate files. Most releases target unclear files, but some reveal the goal to exfiltrate sensitive Telegram data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-aiosendletter Reasons (based on the campaign): - files-exfiltration - target:telegram