A threat actor group known as TeamPCP has been caught backdooring the Telnyx Python SDK on PyPI \u2014 a popular cloud communications library with over 700,000 downloads in February alone. <\/p>\n
On March 27, 2026, two malicious versions of the package, 4.87.1 and 4.87.2, were quietly published to the Python Package Index without any matching commits in the official GitHub repository. <\/p>\n
The tainted packages were built to steal credentials from developer systems running Windows, macOS, and Linux, making it one of the broadest supply chain attacks targeting open-source developers this year.<\/a><\/p>\n This strike came just three days after TeamPCP compromised the LiteLLM AI proxy<\/a> package, signaling a fast-moving and escalating campaign. <\/p>\n The group appears to be systematically targeting trusted open-source libraries used in AI and developer tooling environments. <\/p>\n The back-to-back nature of these attacks shows that TeamPCP has a well-prepared toolkit and reliable methods for slipping malicious code into real package releases without triggering immediate detection.<\/a><\/p>\n Trend Micro analysts identified and documented the Telnyx attack<\/a>, noting that both compromised versions were quarantined by PyPI at 10:13 UTC \u2014 roughly 6.5 hours after first appearing on the platform. <\/p>\n According to the researchers, malicious code was injected directly into the\u00a0 This means that simply running\u00a0 The impact of this attack is significant. Any developer or organization that installed either of the affected versions should treat their systems as fully compromised. <\/p>\n The payload was designed to steal credentials and send them silently to an attacker-controlled server using an encryption chain that includes AES-256-CBC and RSA-4096. <\/p>\n The attack also reached across all three major operating systems, with Windows users facing the additional risk of a boot persistence mechanism that ensured the malware stayed active and ran automatically after every system restart.<\/a><\/p>\n PyPI has since quarantined the malicious versions, and the last confirmed clean release is version 4.87.0. Users who installed the affected packages are strongly advised to downgrade immediately and treat any exposed systems as potentially compromised. <\/p>\n Additionally, credential rotation is strongly recommended for any accounts accessible from affected machines.<\/a><\/p>\n The most notable technical shift in this attack is how TeamPCP concealed the credential-stealing payload inside WAV audio files. <\/p>\n Unlike the earlier LiteLLM attack, where the harvester was embedded directly in the source code as a Base64 blob, the Telnyx variant downloaded the malware at runtime from a command-and-control (C&C) server at\u00a0 The payload was hidden inside structurally valid WAV files that pass standard MIME-type checks, bypass file extension filters<\/a>, and leave no harvester logic visible in the package source code.<\/p>\n The decoded Base64 payload for Linux downloads the WAV file, decodes it, and executes the resulting payload. <\/p>\n The extraction process worked by reading the raw audio frames using Python\u2019s\u00a0 Each byte was XORed against this rotating key to recover the cleartext harvester. This approach made static analysis of the package completely ineffective, since the actual stealing logic never resided in the code at all.<\/p>\n The malicious code was also split across three separate locations in\u00a0 On Windows, the payload installed a disguised executable named\u00a0 Organizations should look for unexpected WAV file downloads from non-media IP addresses<\/a> over port 8080, outbound HTTP requests carrying the\u00a0 All PyPI dependencies should be pinned by hash, and CI\/CD pipelines should be actively monitored for unusual audio file downloads or unexpected outbound connections.<\/a><\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post Hackers Backdoor Telnyx Python SDK on PyPI to Steal Credentials Across Windows, macOS, and Linux<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\ntelnyx\/_client.py<\/code>\u00a0file, with all execution paths triggered at module scope. <\/p>\nimport telnyx<\/code>\u00a0in a Python project<\/a> was enough to activate the payload, with no further action required from the developer.<\/a><\/p>\nWAV Steganography: Malware Hidden Inside Audio Files<\/strong><\/h2>\n
83[.]142[.]209[.]203:8080<\/code>. <\/p>\n![\"The](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhfcC7LOdZTeFMXAr3fYehbmZ0aDwQj-tEGR48XRp-0ei6rS8lMIsvwBqCGxF1FXTDueBbZV7U7nd1aokI-EfFGRTHqREW8r2KxACpN-mGYoD1DuNMjsBzt9dXy1BJfM6Nln6mTbvCpaLImFbv-tithZZbHbVWigxo6FN0XpbQU-6EHjhHTDrEJidwxd3Y\/s16000\/The%2520decoded%2520Base64%2520payload%2520for%2520Linux%2520downloading%2520the%2520WAV%2520file%2520%28Source%2520-%2520Trend%2520Micro%29.webp?ssl=1\")
wave<\/code>\u00a0module, then Base64-decoding the data and splitting it: the first 8 bytes acted as an XOR key, while the remaining bytes formed the encrypted payload. <\/p>\n![\"Base64](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg2N5DWf4CgCu6oj3lLLIpVuoVOuf7i0nr2wP-diTZVhfh_WQeSwfrcEPrhfuR_2C9RvzV834pDguMXiRee8si4c1Z4sVOs5M6WvHe8d3EeMGrXuu_PBvZLGPaui0At25IGJngwvHWodEv6Dx-_MyJHazPDFxKIFO9Il3XIcVL1EHAdE1kglGaxwQuPMJg\/s16000\/Base64%2520decode%2520wrapper%2520function%2520%28Source%2520-%2520Trend%2520Micro%29.webp?ssl=1\")
_client.py<\/code>, making it far harder to catch through a quick visual scan. <\/p>\n![\"Linux](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjsYGG4zFxX6RC456CrMHd6RmJRIUYYfSyCD8mC5Xd0JyHqwpovjfLTFnKuFJPipeJBaTY5GXTjZTphV07DNJsMJ9WTdgXiz8KjcVnqlVBKeVNkAwa-BW1m4pqWq7nEX_K1gHOmqOrCpZlY3K0ZwcXpnqSeJHPtPk5EJHmyC_vG6WdtLAEMSP31UOLdAoY\/s16000\/Linux%2520orchestrator%2520and%2520harvester%2520%28Source%2520-%2520Trend%2520Micro%29.webp?ssl=1\")
msbuild.exe<\/code>\u00a0into the Startup folder for boot persistence. <\/p>\nX-Filename: tpcp.tar.gz<\/code>\u00a0header, and any\u00a0msbuild.exe<\/code>\u00a0files appearing in user Startup directories. <\/p>\n