StepSecurity Details TeamPCP Credential Stealer in Malicious Telnyx PyPI Releases

Summary

StepSecurity found import-triggered malicious code in telnyx 4.87.1 and 4.87.2 that used WAV files to deliver credential theft and persistence payloads. Tests observed C2 connections but no payload download or exfiltration; it advises downgrading and rotating secrets.

Key points

StepSecurity reports that telnyx 4.87.1 and 4.87.2 contained malicious code in the SDK's client module, triggered when applications imported telnyx.
Static analysis found Linux/macOS code that fetched a WAV file, decoded a credential harvester, and was designed to encrypt and exfiltrate collected data.
On Windows, the payload in 4.87.2 was designed to retrieve a binary and place it in the Startup folder as msbuild.exe; a capitalization error prevented this function from running in 4.87.1.
StepSecurity attributes the campaign to TeamPCP based on a shared RSA-4096 key, the tpcp.tar.gz exfiltration signature, and matching encryption commands also found in the litellm compromise.
Controlled Ubuntu and Windows runs observed connections to the C2 during SDK import, but the server did not provide valid WAV payloads; no payload file writes or exfiltration were observed in those tests.
The report advises affected users to downgrade to telnyx 4.87.0, rotate accessible credentials, check for the Windows persistence artifacts, and review outbound traffic to the C2 IP on port 8080.

Article Details

Attack Vectors: Compromised telnyx Python SDK releases 4.87.1 and 4.87.2 were published to PyPI; injected code in telnyx/_client.py executes when the module is imported.
On Linux and macOS, the package fetches ringtone.wav and decodes a credential harvester hidden in WAV audio frames using base64 and XOR.
On Windows, version 4.87.2 fetches hangup.wav, decodes a PE binary, saves it as msbuild.exe in the Startup folder, and executes it.
The Linux/macOS payload encrypts collected credentials and sends them to the C2 server in a tpcp.tar.gz archive.
Defensive Notes: If either compromised release was installed, downgrade to telnyx 4.87.0 and rotate credentials accessible to affected systems, including SSH keys, cloud credentials, tokens, and API keys.
On Windows, check the Startup folder for msbuild.exe and msbuild.exe.lock; treat a found binary as evidence the machine was compromised.
Audit outbound network logs for connections to 83.142.209.203 on port 8080.
The article states that Harden Runner allowed-endpoint policies could block the connection to the C2 endpoint.

Indicators of compromise

Type	Indicator	Context
IPV4	`83[.]142[.]209[.]203`	C2 server used to deliver WAV payloads and receive credential exfiltration.
SHA256	`a9235c0eb74a8e92e5a0150e055ee9dcdc6252a07785b6677a9ca831157833a5`	SHA-256 hash of the malicious telnyx-4.87.2.tar.gz package.
SHA256	`f66c1ea3b25ec95d0c6a07be92c761551e543a7b256f9c78a2ff781c77df7093`	SHA-256 hash of the malicious telnyx-4.87.1.tar.gz package.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/`	C2 exfiltration endpoint receiving the tpcp.tar.gz archive.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/hangup.wav`	C2 URL serving the WAV-encoded Windows binary.
URL	`hxxp[:]//83[.]142[.]209[.]203:8080/ringtone.wav`	C2 URL serving the WAV-steganography payload for Linux and macOS.