TeamPCP Used Malicious Telnyx Python SDK Versions to Steal Credentials

Mar 29, 2026 · Original article ↗

Summary

A technical report says TeamPCP uploaded malicious telnyx Python SDK versions 4.87.1 and 4.87.2 to PyPI. The packages triggered credential theft and persistent payloads across Windows, Linux, macOS, and Kubernetes environments before PyPI quarantined them.

Key points

The malicious versions were uploaded directly to PyPI using a valid publishing token and were not present in the project’s source repository; PyPI quarantined them after about four hours.
Importing the affected package triggered platform-specific loaders, which retrieved payloads concealed in WAV files or embedded in the package.
The report says the payloads targeted cloud, SSH, Kubernetes, database, CI/CD, and cryptocurrency secrets, then encrypted and exfiltrated collected data.
In Kubernetes environments, the harvester could use service-account tokens to access cluster secrets and deploy privileged pods that installed persistent backdoors on nodes.
The Windows payload used a Startup-folder dropper and a RAT; the report describes NTDLL unhooking, ETW patching, and process injection.
The report links the activity to TeamPCP through shared tooling and an RSA public-key fingerprint, and describes related compromises involving Trivy, Checkmarx, LiteLLM, and npm packages.
Organizations that installed the affected versions are advised to investigate, rotate exposed credentials, check for persistence, and review downstream systems.

Article Details

Attack Vectors: TeamPCP uploaded trojanized telnyx Python SDK versions 4.87.1 and 4.87.2 directly to PyPI using a valid PyPI token; the versions were not published in the source repository.
Importing the compromised package executes platform-specific loader code without further user interaction.
The loaders retrieve payloads concealed in WAV audio data; the Windows payload extracts a PE, while the Linux/macOS path runs a Python loader that retrieves a credential harvester.
The harvester collects credentials and secrets from files, environment variables, cloud metadata, and Kubernetes, then encrypts and exfiltrates collected data to C2 infrastructure.
With Kubernetes service-account tokens, the harvester retrieves cluster secrets and creates privileged pods on nodes to deploy a persistent systemd backdoor.
The Windows RAT uses early-bird APC process injection into dllhost.exe and communicates with C2 over HTTP.
Defensive Notes: Treat environments that installed telnyx 4.87.1 or 4.87.2 as potentially breached; investigate and rotate exposed credentials, tokens, keys, certificates, and secrets.
Block the reported C2 indicators and alert on outbound HTTP POST requests with the X-Filename: tpcp.tar.gz header.
Investigate HTTP WAV downloads from bare IP addresses on non-standard ports, and monitor for the reported Startup-folder, sysmon.py, and systemd persistence artifacts.
In Kubernetes, review privileged pods with hostPID, hostNetwork, or host filesystem mounts; restrict service-account access to cluster secrets and privileged pod creation.
Use short-lived, scoped publishing credentials and trusted publishers; inventory dependencies and avoid installing packages in environments with mounted production credentials.
Removing the compromised package alone may not remove persistence; inspect affected hosts and cluster nodes for the backdoor artifacts described in the article.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	C2 domain used for persistent-backdoor polling and listed campaign endpoints.
DOMAIN	`models[.]litellm[.]cloud`	LiteLLM typosquat domain used as an exfiltration endpoint.
DOMAIN	`scan[.]aquasecurtiy[.]org`	Typosquat domain listed as the Trivy RAT variant's C2.
DOMAIN	`tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io`	ICP blockchain canister C2 domain listed for CanisterWorm.
IPV4	`45[.]148[.]10[.]212`	C2 IP listed for the Trivy RAT variant.
IPV4	`83[.]142[.]209[.]11`	Resolved IP for checkmarx.zone, identified as C2 infrastructure.
IPV4	`83[.]142[.]209[.]203`	Primary TeamPCP C2 used for payload delivery and exfiltration.
SHA256	`196b5e0e06424a02e360e28e08d7dcfab7ec8946af9477ca352c6cf6b7d4e9bd`	Hash of the inner PE RAT extracted from the PNG carrier.
SHA256	`23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5`	Hash of malicious _client.py from telnyx 4.87.1.
SHA256	`485952ba5347aa83f00537a4be0bebb274021f773a0203b65142f1b86dfda34d`	Hash of a RAT dropper libcurl.dll variant listed with C2 45.148.10.212.
SHA256	`4eceb569b4330565b93058465beab0e6d5ea09cfba8e7f29d7be1b5a2abd958a`	Hash of the RSA-4096 public key in PEM format, listed as a cross-campaign indicator.
SHA256	`5ce544a8db5d0b0953c966384858e4e8a017e7acba2f5f6d0ac8f529d59939d8`	Hash of the decoded Stage 3 credential harvester.
SHA256	`6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a`	Hash of the sysmon.py persistence backdoor.
SHA256	`7290353a3bc2b18e9ea574d3294b09e28edaa6b038285bb101cf09760f187dcd`	Hash of the malicious Windows msbuild.exe outer PE loader.
SHA256	`7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9`	Hash of malicious telnyx 4.87.1 wheel.
SHA256	`8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2`	Hash of a malicious LiteLLM 1.82.7 wheel listed as a cross-campaign package.
SHA256	`84edce66f09c55bbb44754411bde4b092288d172734df62fac20d6f794b3a2ec`	Hash of the decoded Linux Stage 2 loader.
SHA256	`8eaf4c4d0b82620bcda29b97896e2da0a754205c035721479f7ceafb817e4466`	Hash of the Stage 3 harvester and loader wrapper.
SHA256	`a585277a67a176fe098edf90986670653a5039e03e4028d18dd0b607ed287caa`	Hash of a RAT dropper DLL variant listed with C2 45.148.10.212.
SHA256	`a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5`	Hash of malicious telnyx 4.87.2 source archive.
SHA256	`ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e`	Hash of malicious _client.py from telnyx 4.87.2.
SHA256	`bc40e5e2c438032bac4dec2ad61eedd4e7c162a8b42004774f6e4330d8137ba8`	DER fingerprint of the RSA public key the article identifies as shared across TeamPCP campaign loaders.
SHA256	`cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3`	Hash of malicious telnyx 4.87.2 wheel.
SHA256	`cd6af6c9ba149673ff89a1f1ccc8ec40a265a3b54ad455fbef28dc2967a98e45`	Hash of the CanisterWorm JavaScript variant listed among cross-campaign indicators.
SHA256	`d29deee2e8bec85d2fcaec427f17d677f7de4f8387e00566b0b45ff81157bd31`	Hash of a cross-campaign Python harvester Build B CRLF variant.
SHA256	`d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb`	Hash of a malicious LiteLLM 1.82.8 wheel listed as a cross-campaign package.
SHA256	`d6fc0ff06978742a2ef789304bcdbe69a731693ad066a457db0878279830d6a9`	Hash of a cross-campaign Python harvester variant identified as LiteLLM C2 Build B.
SHA256	`e4e3b176c1255666024d90392e09466a23bf6e8740bf589c6d1ccf2dfff451a4`	Hash of the position-independent shellcode stub used as a reflective PE loader.
SHA256	`e6912e3ec58120bf63edf2e4be6ff2f092c40cfbc655a12f4a463b2ef98d368e`	Hash of the PNG steganographic payload carrier embedded in the Windows PE.
SHA256	`f66c1ea3b25ec95d0c6a07be92c761551e543a7b256f9c78a2ff781c77df7093`	Hash of malicious telnyx 4.87.1 source archive.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/`	C2 endpoint receiving exfiltration POSTs from Telnyx and LiteLLM variants.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/hangup[.]wav`	C2 URL serving the WAV-carried Windows PE payload.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/ringtone[.]wav`	C2 URL serving the WAV-carried Linux credential harvester.
URL	`hxxps[:]//checkmarx[.]zone/raw`	C2 polling URL used by sysmon.py to retrieve payload URLs.
URL	`hxxps[:]//checkmarx[.]zone/vsx`	Exfiltration endpoint listed for the CanisterWorm JavaScript variant.
URL	`hxxps[:]//models[.]litellm[.]cloud/`	URL identified as a LiteLLM-variant exfiltration endpoint on a typosquat domain.