If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (69aee56f4c3bce704bc65574959aee0226417e4d6a6e05e662d6fa235c12815f)
Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application.
1. "pyapiepo" is a cover package that provides some useless features BUT also imports "zscaner"
2. "zscaner", when imported, automatically runs a function that is an entry point to the whole process; it uses the "scan" from "reqinstall" to walk through directories. The package also provides main logic: filtering files, triggering archiving directories and exfiltrating them.
3. "reqinstall" ensures "requests" are installed and provides a directory tree scanning function.
4. "zmaker" provides functions to build archives from collected files.
5. "zsender" provides functions to exfiltrate data, the remote URL and a function to deobfuscate configuration in other packages.
Altogether, they look for "Telegram Desktop" folder, archive user data stored there and exfiltrate to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-04-zscaner
Reasons (based on the campaign):
- target:telegram
- exfiltration-generic
- The malicious code is intentionally included in a dependency of the package
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxp://77[.]91[.]76[.]45:100/OPEN other packages →
IP addresses
- 77[.]91[.]76[.]45 other packages →