Threats Tagged 'mal-2026-17200'

The aseity package on PyPI version 0.1.0 contains malicious code that executes automatically during installation and import. It uses obfuscated and encoded payloads to deploy a multi-stage malware dropper that downloads additional components from a suspicious domain. The malware performs VM and debugger checks, extracts and runs a hidden Python executable, and includes an infostealer that exfiltrates data to a command-and-control server referenced via blockchain transactions. The package employs steganography and native extensions to evade detection and persist on the infected host.