TeamPCP’s Telnyx Supply-Chain Attack Adds WAV Steganography and Windows Persistence
Summary
Malicious Telnyx Python SDK versions 4.87.1 and 4.87.2 used WAV steganography to deliver credential-stealing payloads on Linux/macOS and Windows. PyPI quarantined the packages after about 6.5 hours; affected users should downgrade to 4.87.0 and treat importing systems
Key points
- TeamPCP published malicious Telnyx SDK versions 4.87.1 and 4.87.2 to PyPI on March 27, 2026; PyPI quarantined them after roughly 6.5 hours.
- Importing the affected package triggered malicious code at module scope, with components split across the package source to hinder inspection.
- The payload retrieved credential-stealing code hidden in valid WAV files and used XOR decoding.
- The attack added Windows targeting, installing a disguised msbuild.exe in the user's Startup folder for persistence; Linux/macOS payloads ran detached.
- Stolen data was encrypted and exfiltrated over plaintext HTTP to a raw IP address, creating network-monitoring opportunities.
- The article recommends downgrading to Telnyx 4.87.0, treating systems that imported affected versions as exposed, pinning dependencies by hash, and monitoring CI/CD for unexpected audio downloads.
Article Details
- Attack Vectors
- Malicious Telnyx Python SDK versions 4.87.1 and 4.87.2 were published to PyPI without corresponding upstream GitHub commits. Importing the package was sufficient to trigger the payload at module scope.
- The payload split its components across telnyx/_client.py and used Base64 encoding and obfuscated strings to make malicious code less visible.
- The Linux/macOS and Windows execution paths downloaded credential-harvesting payloads embedded in WAV files from the C&C server; the WAV data was Base64-decoded and XOR-decoded.
- On Windows, the downloaded executable was installed as msbuild.exe in the user's Startup folder for boot persistence and launched with CREATE_NO_WINDOW.
- Stolen data was packaged as tpcp.tar.gz, encrypted using AES-256-CBC and RSA-OAEP, and exfiltrated over HTTP with the X-Filename: tpcp.tar.gz header.
- Defensive Notes
- Downgrade Telnyx installations at versions 4.87.1 or 4.87.2 to the last known clean release, 4.87.0, and treat systems that imported affected versions as exposed.
- Pin PyPI dependencies by hash and monitor CI/CD environments for unexpected audio file downloads.
- Hunt for WAV downloads from non-media IP addresses over port 8080, unexpected msbuild.exe binaries in user Startup folders, outbound HTTP requests containing the X-Filename: tpcp.tar.gz header, and attrib +h activity on .lock files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 83[.]142[.]209[.]203 | C&C and payload-delivery server used to host WAV files and receive exfiltration over HTTP. |
MITRE ATT&CK
T1001.002 · SteganographyCredential-harvesting payloads were concealed in structurally valid WAV audio using Base64 and XOR encoding.T1027 · Obfuscated Files or InformationThe payload was split across locations in _client.py, Base64-encoded, and used obfuscated strings to hinder inspection.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrated the encrypted tpcp.tar.gz archive to the C&C server over HTTP.T1071.001 · Web ProtocolsThe campaign used HTTP for C&C payload downloads and exfiltration.T1547.001 · Registry Run Keys / Startup FolderOn Windows, the downloaded executable was placed in the user's Startup folder as msbuild.exe for boot persistence.
Threat Actors
Vendors
Products
LiteLLMThree days after compromising the LiteLLM AI proxy package, TeamPCP struck again. On March 27, 2026, two malicious versions of the Telnyx Python SDK, a cloud communications library with over 700,000 downloads inPyPIPython SDK, a cloud communications library with over 700,000 downloads in February, were published to PyPI. The payload represents a clear shift in the campaign's tradecraft, combining WAV-embeddedTelnyx Python SDKLiteLLM AI proxy package, TeamPCP struck again. On March 27, 2026, two malicious versions of the Telnyx Python SDK, a cloud communications library with over 700,000 downloads in February, were published to PyPI. The