Threats Tagged 'mal-2026-17927'

The fabtoolkit package on PyPI contains malicious code that executes a payload fetching a remote JSON configuration from an attacker-controlled server with TLS verification disabled. This payload can read arbitrary files, execute arbitrary commands, perform HTTP requests with stolen tokens, probe TCP ports, and establish a reverse shell daemon. It collects sensitive data such as credentials and cloud metadata, packages it, and uploads it to the attacker’s server. The malware enforces single-instance persistence by killing prior instances and is triggered by running 'python -m fabtoolkit' or importing certain functions. The package has no legitimate functionality matching its name.