TeamPCP-Linked Malware Found in Trojanized Telnyx Python SDK Releases
Summary
Socket and independent researchers confirmed that Telnyx Python SDK versions 4.87.1 and 4.87.2 on PyPI contained credential-harvesting malware. PyPI quarantined them; users should downgrade and rotate exposed credentials.
Key points
- Telnyx Python SDK versions 4.87.1 and 4.87.2 were trojanized; version 4.87.0 is identified as the clean baseline.
- Malicious code in src/telnyx/_client.py runs when the package is imported, giving it access to the importing application's runtime environment.
- The Windows path downloads a payload and places msbuild.exe in the Startup folder for persistence; the initial 4.87.1 release had a casing bug that was fixed in 4.87.2.
- The Linux/macOS path retrieves a harvester hidden in WAV files and executes it in memory, then encrypts collected data and sends it to attacker infrastructure.
- The article links the activity to TeamPCP, citing the tpcp.tar.gz archive name and its association with a broader supply-chain campaign.
- PyPI quarantined the malicious releases. Users are advised to downgrade to 4.87.0 or earlier, rotate credentials accessible when the package was imported, and check Windows Startup locations for dropped files.
Article Details
- Attack Vectors
- The attacker trojanized telnyx Python SDK versions 4.87.1 and 4.87.2 on PyPI. Malicious code in src/telnyx/_client.py runs when the module is imported.
- The Windows path downloads hangup.wav, extracts a binary using base64 decoding and 8-byte XOR, and places it in the Startup folder as msbuild.exe. The article reports that the Windows path in version 4.87.1 was disabled by a casing error; version 4.87.2 corrected it.
- The Linux/macOS path downloads ringtone.wav, extracts a Python harvester using base64 and XOR, and executes it in a detached Python process without writing the harvester to disk.
- The malware encrypts collected data, packages it as tpcp.tar.gz, and uploads it to the C2 server over HTTP.
- Defensive Notes
- Remove versions 4.87.1 and 4.87.2 and use telnyx 4.87.0 or earlier; verify that internal mirrors and dependency caches have purged the malicious releases.
- Treat credentials and secrets accessible to processes that imported the compromised versions as exposed, and rotate them, including API keys, tokens, SSH keys, and CI/CD secrets.
- On Windows, inspect the Startup folder for msbuild.exe, msbuild.exe.lock, and msbuild.exe.tmp. On Linux/macOS, the article warns that the payload may leave no persistent artifacts.
- Block 83[.]142[.]209[.]203 and review network logs for connections to it on port 8080.
- Check for import-time malicious code in package modules, not only install-time hooks, and investigate releases that lack corresponding source-control tags or commits.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 83[.]142[.]209[.]203 | C2 server used to deliver WAV payloads and receive exfiltrated data over port 8080. |
| URL | hxxp[:]//83[.]142[.]209[.]203:8080/ | C2 endpoint used to receive the exfiltration bundle via HTTP POST. |
| URL | hxxp[:]//83[.]142[.]209[.]203:8080/hangup.wav | C2-hosted WAV payload downloaded by the Windows attack path. |
| URL | hxxp[:]//83[.]142[.]209[.]203:8080/ringtone.wav | C2-hosted WAV payload used to deliver the Linux/macOS harvester. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe implant uses a base64-encoded payload, XOR extraction, and WAV steganography to obscure payload content.T1036 · MasqueradingThe Windows payload is named msbuild.exe to resemble Microsoft's Build Engine.T1041 · Exfiltration Over C2 ChannelThe malware sends the encrypted tpcp.tar.gz exfiltration bundle to the C2 server.T1059.006 · PythonThe Linux/macOS path spawns a Python process that executes the extracted harvester from standard input.T1070.004 · File DeletionThe malware uses a temporary directory that is recursively deleted when its operation ends.T1071.001 · Web ProtocolsPayload downloads and exfiltration use HTTP communications with the C2 server.T1105 · Ingress Tool TransferThe malware downloads hangup.wav or ringtone.wav from the C2 server to retrieve payloads.T1140 · Deobfuscate/Decode Files or InformationThe malware decodes base64 data and reverses an 8-byte XOR operation to extract payloads from the WAV files.T1195 · Supply Chain CompromiseThe attacker trojanized telnyx Python SDK releases 4.87.1 and 4.87.2 on PyPI.T1547.001 · Registry Run Keys / Startup FolderThe functioning Windows path places msbuild.exe in the Startup folder for persistence; the article says this path was fixed in version 4.87.2.T1560.001 · Archive via UtilityThe collected data and encrypted session key are packaged together as tpcp.tar.gz before exfiltration.
Threat Actors
Vendors
SocketSocket and independent researchers confirmed that the telnyx Python SDK releases 4.87.1 and 4.87.2 on PyPI were trojanized with credential-harvesting malware delivered via a supply-chain compromise.TelnyxSocket and independent researchers confirmed that the telnyx Python SDK releases 4.87.1 and 4.87.2 on PyPI were trojanized with credential-harvesting malware delivered via a supply-chain compromise.
Products
PyPISocket and independent researchers confirmed that the telnyx Python SDK releases 4.87.1 and 4.87.2 on PyPI were trojanized with credential-harvesting malware delivered via a supply-chain compromise.Telnyx communications platformThe telnyx library is the official Python SDK for the Telnyx communications platform, providing developers with programmatic access to APIs for voice calls, SMS/MMS messaging, WhatsApp, fax, IoT connectivity, and SIPTelnyx Python SDKSocket and independent researchers confirmed that the telnyx Python SDK releases 4.87.1 and 4.87.2 on PyPI were trojanized with credential-harvesting malware delivered via a supply-chain compromise.