TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM

Attackers associated with TeamPCP have compromised the Telnyx Python SDK, publishing malicious versions 4.87.1 and 4.87.2 to PyPI. The attack marks a significant evolution in tradecraft, utilizing split-file code injection to hide malicious components across the package and employing audio steganography. By embedding XOR-encrypted credential harvesters within structurally valid WAV files, the malware bypasses traditional static analysis and file extension filters. Unlike previous campaigns that focused on Linux, this variant introduces dual-platform targeting with specific persistence mechanisms for Windows systems, including the use of a hidden 'msbuild.exe' in the Startup folder. Organizations are urged to downgrade to version 4.87.0 immediately, treat any installation of the affected versions as a total compromise, and monitor network traffic for connections to the identified command-and-control infrastructure. Read Full Article