TeamPCP Uses WAV Steganography to Deliver Credential Stealers in Malicious Telnyx PyPI Releases
Summary
TeamPCP’s malicious telnyx PyPI releases 4.87.1 and 4.87.2 use WAV steganography to deliver credential stealers across Windows, Linux and macOS. Researchers describe Windows persistence and cross-platform data exfiltration; PyPI quarantined the project and users are ur
Key points
- TeamPCP published malicious telnyx versions 4.87.1 and 4.87.2 to PyPI on March 27, 2026; the project is now quarantined.
- Security researchers report that code injected into telnyx/_client.py runs when the package is imported and uses WAV files to deliver payloads.
- On Windows, the malware extracts an executable from hangup.wav and places it as msbuild.exe in the Startup folder for persistence.
- On Linux and macOS, it fetches ringtone.wav, runs a collector in memory from a temporary directory, and deletes the directory afterward; no persistence mechanism is reported.
- The harvester collects sensitive data and sends it as tpcp.tar.gz to 83.142.209[.]203:8080. How TeamPCP obtained the PyPI token is unknown.
- Recommended actions include auditing for the affected versions, downgrading to 4.87.0, rotating secrets, checking the Windows Startup folder for msbuild.exe, and blocking the exfiltration endpoint.
Article Details
- Attack Vectors
- TeamPCP published trojanized telnyx versions 4.87.1 and 4.87.2 to PyPI.
- Malicious code injected into telnyx/_client.py executes when the package is imported.
- The payload is delivered inside WAV files using audio steganography.
- On Windows, the malware drops msbuild.exe into the Startup folder for persistence.
- On Linux and macOS, the collector runs in memory from a temporary directory, harvests data, and then deletes the directory contents.
- Collected data is sent as tpcp.tar.gz in an HTTP POST request to the reported C2 address.
- Defensive Notes
- Audit Python environments and requirements.txt files for telnyx==4.87.1 and telnyx==4.87.2; downgrade to the clean 4.87.0 version.
- Assume affected systems may be compromised and rotate secrets.
- Check the Windows Startup folder for msbuild.exe.
- Block the reported C2 address 83.142.209[.]203.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 83[.]142[.]209[.]203 | Reported C2 and exfiltration address used by the malware. |
MITRE ATT&CK
T1027.003 · SteganographyThe payload was concealed in WAV files using audio steganography.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrates harvested data as tpcp.tar.gz through an HTTP POST request to its C2 address.T1059.006 · PythonMalicious Python code in telnyx/_client.py runs when the package is imported.T1105 · Ingress Tool TransferThe malware downloads WAV files from its C2 server to extract payloads.T1195.002 · Compromise Software Supply ChainTeamPCP compromised the telnyx package and published trojanized versions 4.87.1 and 4.87.2 to PyPI.T1547.001 · Registry Run Keys / Startup FolderOn Windows, the malware places msbuild.exe in the Startup folder to run at user logon.T1552.001 · Credentials In FilesThe reported prior TeamPCP harvester collected credentials from .env files.T1552.003 · Shell HistoryThe reported prior TeamPCP harvester collected credentials from shell histories.
People
Threat Actors
LAPSUS$Named in the article as a cybercriminal group that TeamPCP reportedly announced collaboration with for extortion and ransomware operations; the article does not establish its involvement in the telnyx compromise.TeamPCPIdentified in the article as responsible for publishing the malicious telnyx package versions and linked to prior supply-chain compromises of Trivy, KICS, and litellm.VectDescribed as an emerging ransomware group that TeamPCP reportedly announced collaboration with for extortion and ransomware operations; the article does not establish its involvement in the telnyx compromise.
Products
LiteLLMThe campaign persists on Windows via a Startup-dropped msbuild.exe, exfiltrates collected data to 83.142.209[.]203:8080, and is linked to prior supply-chain compromises of Trivy, KICS, and litellm.TelnyxTeamPCP compromised the telnyx PyPI package by publishing malicious versions 4.87.1 and 4.87.2 that use audio steganography in .WAV files to deliver credential-harvesting payloads across Windows, Linux, and macOS; users
Tools
KICSThe campaign persists on Windows via a Startup-dropped msbuild.exe, exfiltrates collected data to 83.142.209[.]203:8080, and is linked to prior supply-chain compromises of Trivy, KICS, and litellm.TrivyThe campaign persists on Windows via a Startup-dropped msbuild.exe, exfiltrates collected data to 83.142.209[.]203:8080, and is linked to prior supply-chain compromises of Trivy, KICS, and litellm.